Apps Config.php Parameters

You could place your email server configuration in email.config.php. This allows you to easily create and manage custom configurations or to divide a large complex configuration file into a set of smaller files. These custom files are not overwritten by ownCloud, and the values in these files take precedence over config.php.

ownCloud may write configurations into config.php. These configurations may conflict with identical keys already set in additional config files. Be careful when using this capability!

This setting only applies when the operating mode of the files_antivirus app is set to executable mode. See the documentation for more details.

This setting only applies when the operating mode of the files_antivirus app is set to executable mode. See the documentation for more details.

To enable scripting in PDF files, set the value to 'yes'. Any other value will be treated as disable scripting.

Configuring the download links for ownCloud clients, as seen in the first-run wizard and on Personal pages

Path to the 'keytab' file to use, defaults to '/etc/krb5.keytab'.

Timeout before re-enabling SPNEGO based authentication after logout, defaults to 60 seconds.

The domain name - remove from principals to match the pure user name.

Example: 'alice@corp.dir' will look for the user 'alice' in LDAP if 'kerberos.domain' is set to 'corp.dir'.

The name of the login button shown on the login page.

If set to true, the login page will immediately try to log in via Kerberos.

You have to set a Metrics secret to use the dashboard. You cannot use the dashboard without defining a secret. You can use any secret you like. In case you want to generate a random secret, use the following example command: echo $(tr -dc 'a-z0-9' < /dev/urandom | head -c 20) It is also possible to set this secret via an occ command which writes key and data to the config.php file. Please see the occ command documentation for more information.

Both, wopi.token.key and wopi.proxy.key are random keys created by the ownCloud admin.

The keys are used by ownCloud to create encrypted JWT tokens for the communication with your Microsoft Office Online instance. The keys must be distinct. Note that wopi.token.key must be at least 32 bytes long.

You can use the following example command to generate a random key: echo $(tr -dc 'a-z0-9' < /dev/urandom | head -c 32)

This is the URL of the Microsoft Office Online instance ownCloud communicates with. Keep in mind that you need to grant communication access at your Microsoft Office Online instance with this ownCloud instance. For further information, read the ownCloud documentation.

Restrict access to Microsoft Office Online to a defined group. Please note, only one group can be defined. Default = empty = no restriction.

This global option defines the proxy URL if you are a Microsoft Business user.

Note that you will get a working URL from ownCloud Support after you provide a written declaration that your company has an eligible Microsoft Business contract.

This global option defines if Office users are business users.

In that case, Office Online will check if the user logged in has an Office 365 business account. If not, the user must sign in and Office Online will check if the subscription is valid. Use yes to enable it and no to disable it or remove the key completely. To use this option, you need at least ownCloud’s Microsoft Office Online app version 1.6.0.

This key is necessary for security reasons. Users will be asked to click a login button each time when accessing the ownCloud app after a fresh start of their Microsoft Teams app or after idle time. This behavior is by design. The button name can be freely set based on your requirements.

Please note, only one group can be defined. Default = empty = no restriction.

The detailed configuration of that array depends on the S3 provider. This example can therefore only show the general construct. See the "S3 Compatible Object Storage as Primary Storage Location" documentation for more details.

Register WND as extension into the Activity app in order to send information about what the wnd:process-queue command is doing. The activity sent will be based on what the wnd:process-queue detects, and the activity will be sent to each affected user. There won’t be any activity being sent outside of the wnd:process-queue command.

wnd:listen + wnd:process-queue + activity app are required for this to work properly. See wnd.activity.sendToSharees below for information on how to send activities for shared resources. Please consider that this can have a performance impact when changes are sent to many users.

The wnd:process-queue command will also send activity notifications to the sharees if a WND file or folder is shared (or accessible via a share). It’s REQUIRED that the wnd.activity.registerExtension flag is set to true (see above), otherwise this flag will be ignored. This flag depends on the wnd.activity.registerExtension and has the same restrictions.

The same timeout will be applied for all the connections.

Increase it if requests to the server sometimes time out. This can happen when SMB3 encryption is selected and smbclient is overwhelming the server with requests.

By default, we will reset the password with error code 13, which means access denied. Depending on circumstances, you might want to add the error code 1, which means an operation not permitted (although there could be cases where this "operation not permitted" might not be caused by a wrong password).

Some examples:

The password reset feature can be disabled by providing an empty list

Note that disabling the password reset feature can lead to an account lockout if such feature is enabled in the target windows / samba machine.

There are 3 possible values: none, stat and getxattr:

Note that the ACLs (if active) will be evaluated and applied on top of this mechanism.

The WND app doesn’t know about the users or groups associated with ACLs. This means that an ACL containing "admin" might refer to a user called "admin" or a group called "admin". By default, the group membership component considers the ACLs to target groups, and as such, it will try to get the information for such a group. This works fine if the majority of the ACLs target groups. If the majority of the ACLs contain users, this might be problematic. The cost of getting information on a group is usually higher than getting information on a user. This option makes the group membership component assume the ACL contains a user and checks whether there is a user in ownCloud with such a name first. If the name doesn’t refer to a user, it will get the group information. Note that this will have performance implications if the group membership component can’t discard users in a large number of cases. It is recommended to enable this option only if there are a high number of ACLs targeting users.

Having this feature enabled implies that whenever a WND process detects a wrong password in the storage - maybe the password has changed in the backend - all WND storages that are in-memory will be notified in order to reset their passwords if applicable and not to requery again.

The intention is to prevent a potential password lockout for the user in the backend. As with PHP lower than 7.4, this feature can take a lot of memory resources. This is because WND keeps the storage access and its caches in-memory. With PHP 7.4 or above, the memory usage has been reduced significantly. Alternatively, you can disable this feature completely.

A map of servers with the required data to get the Kerberos credentials in order to access them.

Each key of the map must be unique and identifies a server. This ID will be used in the web UI to configure the mount points to use the Kerberos authentication. You can use any ID (choose one meaningful and easy to remember).

The data contained in each key is as follows:

Available mapping types:

The current use is to update the WND storages (with "login credentials, saved in DB" authentication) when an ACL changes via the smb_acl app

The listener will reconnect to the DB after given seconds. This will prevent the listener to crash if the connection to the DB is closed after being idle for a long time.

A higher number implies that more items are allowed, increasing the memory usage.

Real memory usage per item varies because it depends on the path being cached. Note that this is an in-memory cache used per request. Multiple mounts using the same permission manager will share the same cache, limiting the maximum memory that will be used.

A glyph is a character like ñ as used in the spanish word señorita which can be composed by two different byte sequences.

With UTF-8, glyphs can have two valid representations of these sequences in filesystems. Normalization makes it possible to determine whether any two Unicode strings are equivalent. The most used normalization forms are NFC and NFD. By default, ownCloud usually normalizes names to NFC. With macOS and HFS+ as filesystem, NFD is required. When using WND collaborative mount points connecting to macOS with HFS+, or any other filesystem using NFD, probing both forms can be enforced by setting the config variable wnd2.cachewrapper.normalize to true. This is necessary because if a file accessed via collaborative WND contains NFD characters, WND will not find the file and the WND app will assume user doesn’t have access to it. As a result, the file will not be shown.

As a mandatory prerequisite, the mount point setting Compatibility with Mac NFD encoding must be checked.

Time to Live (TTL) in seconds to be used to cache information for the WND2 (collaborative) cache wrapper implementation. The value will be used by all WND2 storages. Although the cache isn’t exactly per user but per storage id, consider the cache to be per user, because it will be like that for common use cases. Data will remain in the cache and won’t be removed by ownCloud. Aim for a low TTL value in order to not fill the memcache completely. In order to properly disable caching, use -1 or any negative value. 0 (zero) isn’t considered a valid TTL value and will also disable caching.

Enables admins to specify rules and conditions (file size, file mimetype, group membership and more) to automatically assign tags to uploaded files. Values: tagbased (default) or userbased.