Site Resource Settings

Configure settings for resources on the platform such as alerts, apps, APIs, connections, comments, discussions, groups, tickets, users, reviews, and business security.

This section contains information about the configuration settings defined within the Akana API Platform, which apply to the entire Community Manager developer portal.

For information about the configuration settings defined in the Akana Administration Console, which apply only to the specific container, refer to Admin Console Settings.

Table of Contents

• Where do I configure settings for the platform?
• How do I configure settings for alerts?
• How do I configure settings for APIs?
• How do I configure settings for apps?
• How do I configure App OAuth Profile Authorization settings?
• How do I configure settings for comments?
• How do I configure settings for app/API connections?
• How do I configure settings for discussions?
• How do I configure settings for groups?
• How do I configure settings for login policy?
• How do I configure settings for model objects?
• How do I configure settings for password policy?
• How do I configure settings for reviews?
• How do I configure settings for business security?
• What information is stored in the session cookie?
• How do I add the domain attribute to the session cookie for the Community Manager developer portal?
• How do I configure CAPTCHA on the platform?
• How do I configure settings for tickets?
• How do I configure settings for users?
• How do I configure settings for two-factor authentication of users (2FA)?
• How do I prevent referencing external sites in Community Manager developer portal content pages?

Where do I configure settings for the platform?

You can configure many basic settings that control various aspects of the platform and how it operates.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

You can control settings for the following resources:

• Alerts: see, How do I configure settings for alerts?
• APIs: see, How do I configure settings for APIs?
• Apps: see, How do I configure settings for apps?
• Comments: see, How do I configure settings for comments?
• App/API connections: see, How do I configure settings for app/API connections?
• Discussions: see, How do I configure settings for discussions?
• Groups: see, How do I configure settings for groups?
• Login policy: see, How do I configure settings for login policy?
• Models in the Model Library: see, How do I configure settings for model objects?
• Password policy: see, How do I configure settings for password policy?
• Reviews: see, How do I configure settings for reviews?
• Business security: see, How do I configure settings for business security?
• Tickets: see, How do I configure settings for tickets?
• Users: see, How do I configure settings for users?
• User two-factor authentication: see, How do I configure settings for two-factor authentication of users (2FA)?

The following additional site configuration settings are available:

• Site settings: see, Site Settings
• Country codes for use in telephone numbers: see, Country Codes
• Security challenge questions: see, Security Challenge Questions

How do I configure settings for alerts?

You can configure alert settings to determine which features will be available for alerts on the platform.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

To configure alert settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Alerts.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for APIs?

You can configure API settings to determine which features will be available for all APIs on the platform. If a feature is disabled in the API settings page, it will not be present in the user interface.

Unless otherwise noted, settings are either enabled or disabled.

You can configure the API settings shown in the tables below:

• General API Settings
• Public API Settings
• Private API Settings

Note: When you change a setting, it might take up to five minutes for the change to take effect.

General API Settings

Public API Settings

Private API Settings

To configure API settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > APIs.
3. Change the settings as needed. For explanations of your choices, refer to the tables above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for apps?

You can configure app settings to determine which features will be available for all apps on the platform. If a feature is disabled in the app settings page it will not be present in the user interface.

Unless otherwise noted, settings are either enabled or disabled.

Available app configuration settings are shows in the tables below:

• General App Settings
• Public App Settings
• Private App Settings
• Registered User Settings

Note: When you change a setting, it might take up to five minutes for the change to take effect.

General App Settings

Public App Settings

Private App Settings

Registered User Settings

To configure app settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Apps.
3. Change the settings as needed. For explanations of your choices, refer to the tables above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure App OAuth Profile Authorization settings?

As part of app setup, app developers can specify which settings they want to use when connecting to an API using OAuth. These settings are configured from the App Details page: App Details > OAuth Profile.

There are five groups of settings on this page. The first four are controlled by the app developer and are detailed in What are the settings available on the App OAuth Profile page? (app developer help):

• Branding Settings
• Access Token Settings
• Authentication Settings
• ID Token Settings

Settings in the last group are controlled by the Site Admin or specially authorized app developers only:

• Authorization Settings

The last set, Authorization Settings are normally not visible to the app developer. In most cases, these settings can only be configured by the Site Admin. However, the Site Admin can implement a custom workflow that allows app developers to modify these settings. If the custom workflow is in place, app developers will see the settings.

Note: These settings give the app developer significant responsibility. In most cases, app developers should not be able to configure these settings for their apps. Only implement the custom workflow that allows app developers to modify these settings if you are absolutely sure they fully understand the meaning of the various settings and will use them appropriately.

Information about the additional Authorization settings normally available only to a Site Admin is given in the following table.

Authorization Settings

To configure app OAuth profile settings

1. Log in to the Community Manager developer portal.
2. Go to the App Details page for the app, and click OAuth Profile.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

For information about how to implement custom workflow to enable these settings for app developers on the OAuth Profile page, refer to Custom Workflows in the Community Manager developer portal.

How do I configure settings for comments?

You can configure settings to determine which features will be available for all comments on the platform.

When you change a setting, it might take up to five minutes for the change to take effect.

Note: There is an additional setting relating to comments, that limits the types of files users can upload to comments on discussions, tickets, alerts, or reviews. It's in the security settings since it relates to platform security; see, How do I configure settings for business security?

To configure comment settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Comments.
3. Change the setting as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for app/API connections?

You can configure connection settings to determine which features will be available for app/API connections on the platform. If a feature is disabled in the connection settings page it will not be present in the user interface.

Unless otherwise noted, settings are either enabled or disabled.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

General App/API Connection Settings

To configure app/API connection settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Connections.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for discussions?

You can configure settings to determine which features will be available for discussions on the platform.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

Discussion Settings

To configure discussion settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Discussions.
3. Change the settings as needed. For the workflow definition, you can:
   • Choose the out-of-the box workflow, workflow:definition:discussion.
   • Choose a custom workflow, if a Site Admin or Business Admin uploaded a custom workflow for discussions.
   • Revert to the default, no workflow for discussions, if a workflow was previously assigned.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for groups?

You can configure group settings to determine which features will be available for all groups on the platform. If a feature is disabled in the group settings page it will not be present in the user interface.

Unless otherwise noted, settings are either enabled or disabled.

Available group configuration settings are shows in the tables below:

• General Group Settings
• Public Group Settings
• Private Group Settings

Note: When you change a setting, it might take up to five minutes for the change to take effect.

General Group Settings

Public Group Settings

Private Group Settings

To configure group settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Groups.
3. Change the settings as needed. For explanations of your choices, refer to the tables above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for login policy?

You can configure login policy settings to control the login rules for local users logging in to the platform and for the Community Manager developer portal session configuration.

A value of 0 (zero) in one of these fields indicates that there is no value specified, with the exception of Active Login Session Timeout (see below).

Note: When you change a setting, it might take up to five minutes for the change to take effect.

Login Policy Settings

To configure login policy settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Login Policy.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for model objects?

For model objects, you can upload a custom workflow document in More > Admin > Workflows (see, How do I set up and manage custom workflows?) and then assign it in More > Admin > Settings > Models.

To configure model object settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Models.
3. Change the workflow definition. If your custom workflow does not appear on the drop-down list, it was not yet uploaded or an incorrect resource type was assigned to it. See, I uploaded a custom workflow, but it isn't showing as available. What do I do?
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for password policy?

You can configure settings to control password policy for local users logging in to the platform.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

User Settings

To configure password policy settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Password Policy.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for reviews?

You can configure settings to determine which features will be available for reviews on the platform.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

Review Settings

To configure review settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Reviews.
3. Change the settings as needed. For the workflow definition, you can:
   • Choose the out-of-the box workflow, workflow:definition:review.
   • Choose a custom workflow, if a Site Admin or Business Admin uploaded a custom workflow for reviews.
   • Revert to the default, no workflow for reviews, if a workflow was previously assigned.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for business security?

You can configure settings to control the level of security associated with platform elements, and to control certain elements relating to security that affect platform users.

You can use the default out-of-the-box user workflow in combination with user settings and business security settings relating to users, to control user experience on the platform and if needed to restrict what users can do. If you need more flexibility, you can design your own custom workflow.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

Business Security Settings

onload,onerror,onmouseout,onmouseover,eval

To configure business security settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Security.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

What information is stored in the session cookie?

When a user logs in to the Community Manager developer portal, a session cookie is created. The cookie is named: AtmoAuthToken_{fedmemberID}.

The cookie includes information that affects the user's session, such as:

• Login information
• Time the session started, and time it is valid for (might be default values or customized in settings)
• The user's permissions to add, modify, delete, and view resources such as apps, APIs, and groups
• In some cases, information about the domain. See, How do I configure settings for business security? above. The Domain and SameSite attributes are set for the cookie if these fields are enabled in the security settings.

How do I add the domain attribute to the session cookie for the Community Manager developer portal?

As an added security step, you can define the domain attribute in the session cookie for the Community Manager developer portal.

There are three possible values for this setting, as shown below.

To set this up, you'll need to run the database query shown below. Where placeholder values in square brackets are shown below, specify the appropriate values for your installation:

• The appropriate value from the three options above
• Your FedmemberID

SELECT * FROM BUSINESS_SECURITY_SETTINGS;
update BUSINESS_SECURITY_SETTINGS set AUTH_TOKEN_COOKIE_DOMAIN = '[domain_attribute_value]' 
where BUSINESSID = (SELECT BUSINESSID FROM TENANTS WHERE fedmemberid = '[FedmemberID]');

Examples

The example below uses the second attribute value, com.soa.auth.token.cookie.domain.hostname.mustset, and a FedmemberID of acmepaymentscorp.

SELECT * FROM BUSINESS_SECURITY_SETTINGS;
update BUSINESS_SECURITY_SETTINGS set AUTH_TOKEN_COOKIE_DOMAIN = 'com.soa.auth.token.cookie.domain.hostname.mustset' 
where BUSINESSID = (SELECT BUSINESSID FROM TENANTS WHERE fedmemberid = 'acmepaymentscorp');

Sample cookie with the com.soa.auth.token.cookie.domain.hostname.mustset setting enabled. The Domain value is in the last line.

Set-Cookie: AtmoAuthToken_atmosphere=TokenID%3D337b02b3-24de-11e9-975c-e9caa5f7441a%2Cclaimed_id%3Durn%3Aatmosphere%3Auser%3Aatmosphere%3A5f138d5a-cae8-4ab7-ba4a-e87791e669bd%2CissueTime%3D1548887237660%2CexpirationTime%3D1548889097655%2CUserName%3DJaneMead%2CUserFDN%3D5f138d5a-cae8-4ab7-ba4a-e87791e669bd%252Eatmosphere%2CAttributesIncluded%3Dfalse%2Csig%3DFwCSv4diSnn2-HqT46YsyR_l-d73HXDl3zL34cPnjKodxdHNzhmk8LvO5tO6nwKYBZAGDYAHZU0czjLykjPt-gMnFh7hDQ76NT5wIj41_1SkVExO7SnRjgCSw56htRdoVxJIw5uF96JNjzAtmVzPm7G5yWLoOrr4wZAhfVmxPj8_b95BrhLM4oRPCYEIZtNireJ_ljrLwCDnASPkmNZhChn-F1787fVyWigF-0Id-KnWmWEanl-3ONaNWPJDyNkaLw5Kpc7uGPs6Pp1WmO1qgudForBXFakYi8G7Lyf-a7I4FM2L0Z6l7Ra6tsESrZIkAKrt019IU7ReOQqnY4goZQ;path=/;HttpOnly;Domain=portal-4.api.acmepaymentscorp.com;expires=Wed, 30 Jan 2019 22:58:17 GMT

Sample cookie with the com.soa.auth.token.cookie.domain.domainname setting enabled. The Domain value is in the last line.

Set-Cookie: AtmoAuthToken_atmosphere=TokenID%3Dea60ad03-24dc-11e9-975c-e9caa5f7441a%2Cclaimed_id%3Durn%3Aatmosphere%3Auser%3Aatmosphere%3A5f138d5a-cae8-4ab7-ba4a-e87791e669bd%2CissueTime%3D1548886685517%2CexpirationTime%3D1548888545512%2CUserName%3DJaneMead%2CUserFDN%3D5f138d5a-cae8-4ab7-ba4a-e87791e669bd%252Eatmosphere%2CAttributesIncluded%3Dfalse%2Csig%3DJqN9yPJwB4T-BnzexNGZ-kSSR3TqD5rg9TIM3FoJkdAUhSw4-epHGT4aKGgsMrfnCpzoiAkIHHOq9oEO54nCHy2LFc5D7-jZnJIdi2837LshgiSc1m-aCcZj74or1DOS7ZBFyeE8re63-zze3fTyb-igjQ_IT-CNN9qNbMx8fqEl84Qa8Dyq0M6kXQA1YH12ibEHgA-laJr07B4phZP2wo2EmhxfSgk8XwacKd6OeoGZPYhYN6pfcnVAtGrH5aPan7APg_f9BOf9FnSgnbOiz6UAqKpqwr3o3yeDfPbcGSGbKmIO4nUWMHtLfAr2X_f8hpeGFgOaYFBmLjw1CMKmqg;path=/;HttpOnly;Domain=api.acmepaymentscorp.com;expires=Wed, 30 Jan 2019 22:49:05 GMT

How do I configure CAPTCHA on the platform?

The Community Manager developer portal's security features include the capability for the Site Admin to enable CAPTCHA challenge/response tests on certain pages. Using a CAPTCHA helps ensure that the entity performing the action is a human, not a bot.

The feature supports Google reCAPTCHA, reCAPTCHA v2, for validation of users by means of the "I'm not a robot" check box.

Note: This feature does not support invisible reCAPTCHA or reCAPTCHA Android.

If you enable CAPTCHA support in the security settings, users will have to answer CAPTCHA challenges on these pages:

• Sign Up
• Forgot Password

Before enabling the feature, you must set up a Google reCAPTCHA account. Set up the correct domain for your Community Manager developer portal in the reCAPTCHA account, without protocol (for example, acmepaymentscorp.com), and get the values for the Site Key and the Secret.

Once the Google reCAPTCHA account is set up with the domain value for the Community Manager developer portal (for example, acmepaymentscorp.com), and the Community Manager developer portal setting is enabled and set up with the CAPTCHA values, users signing up or clicking Forgot Password will be presented with a CAPTCHA challenge which they must pass as part of entering information on those pages.

To enable CAPTCHA support in the Community Manager developer portal

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Security.
3. In the CAPTCHA Support field, click Enabled.
4. In the CAPTCHA Site Key field, enter the Site Key value for your reCAPTCHA account.
5. In the CAPTCHA Secret Key field, click Edit, and then enter the secret value for your reCAPTCHA account.

   Note: The CAPTCHA Secret Key is never displayed anywhere in the Community Manager developer portal user interface. In addition, the Community Manager developer portal API doesn't return the secret key. It's encrypted and stored securely in the database.

   Click Save.

   If needed, you can use the Reset button at any point before saving, to remove changes you just made.

How do I configure settings for tickets?

You can configure ticket settings to determine which features will be available for tickets on the platform. If a feature is disabled in the ticket settings page it will not be present in the user interface.

Unless otherwise noted, settings are either enabled or disabled.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

General Ticket Settings

To configure ticket settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Tickets.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for users?

You can configure user settings to determine which features will be available for users on the platform. If a feature is disabled in the user settings page it will not be present in the user interface.

Unless otherwise noted, settings are either enabled or disabled.

Note: When you change a setting, it might take up to five minutes for the change to take effect.

User Settings

To configure user settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > Users.
3. Change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I configure settings for two-factor authentication of users (2FA)?

You can configure user settings to determine whether two-factor authentication is in use in the platform, and if so, to specify values that guide the authentication process.

For information about how to implement 2FA, see How do I implement two-factor authentication for platform users?

2FA Settings

To configure user 2FA settings

1. Log in as a Site Admin and go to the Admin section.
2. Go to More > Admin >Settings > User 2FA.
3. On the Two-Factor Verification Settings page, change the settings as needed. For explanations of your choices, refer to the table above.
4. Click Save.

   If needed, you can use the Reset button at any point before saving to remove changes you just made.

How do I prevent referencing external sites in Community Manager developer portal content pages?

It's possible to reference an external website within an <iframe> tag in a Community Manager developer portal content page, using the &doc parameter:

{protocol}://{hostname}/{tenant}/#!{sitepage}&doc={URL-encoded external URL}

The example below illustrates how this might look using the Simple Developer theme's documentation page, and referencing the external website http://www.example.com:

http://acmepaymentscorp.com/acmepaymentscorp/#!documentation&doc=http%3A%2F%2Fexample.com

However, this feature could be an insecurity, since the external site to be displayed could potentially be modified via a malicious content injection. For Site Admins who want to disable the ability to reference external sites in a Community Manager developer portal content page, there is a security setting, Allow display of external content in developer portal content pages. See How do I configure settings for business security? above.

Related Topics