Advanced configuration
This reference lists the iGrafx platform's advanced configuration properties — each with its default, where you can set it, and what it controls.
How to set an option
You can set most properties two ways: as a Java system property (a command-line option) or in the igrafx.properties file in the base directory. The recommended approach is igrafx.properties. Some options can only be set as a system property — the Configured in column says which.
Setting a system property depends on your application server and environment — set it the same way igrafx.basedirectory is set.
To use igrafx.properties, edit the file in the base directory and add a line with the property name and value:
igrafx.my.advanced.configuration=true
Save the change and restart the platform. In a clustered installation, make sure every node uses the same value — for example by sharing one igrafx.properties file across all nodes.
Available options
| Property | Default | Configured in | Description |
|---|---|---|---|
igrafx.indexing.fulltext.delay | 30000 (ms) | System property or igrafx.properties | Milliseconds between full-text indexing runs. After each run, the indexer waits this long before checking for new content to index. |
igrafx.security.frameoptions | sameorigin | System property | Sets the X-Frame-Options header and the CSP frame-ancestors directive. sameorigin lets the product be embedded in iframes from the same server; deny blocks all framing; disable allows framing from anywhere. ℹ️ Excel document previews for external files don't work when set to deny. |
igrafx.security.csp | report-only | System property | Content Security Policy enforcement level: disable, report-only, or enforce. Currently defaults to report-only with a fixed set of directives, so customization and enforcement aren't yet possible — contact your account manager if the default directives don't suit enforcement in your environment. See 2026-02-11 CSP / Content Security Policy with 19.21. |
igrafx.security.samesitecookies | unset | System property | Sets the SameSite cookie attribute. Unset by default in pre-deployed installations, leaving it to the application server (commonly None). None is the only value that works without HTTPS. With HTTPS, choose None, Lax, or Strict — Lax and Strict aren't currently compatible with SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. authentication. |
igrafx.security.securecookies | unset | System property (17.5.2 and later) | Set to true to force cookies to be marked Secure in environments where the application server doesn't recognize it's running under HTTPS. If unset, the application server's configuration applies. |
igrafx.security.installation.restapienabled | false | System property | Whether the REST API is enabled during installation. Applies only to a new install, not upgrades. Set true for fully automated deployments. |
igrafx.caching.cleanup.excel.duration | 86400000 (ms) | System property or igrafx.properties | How long an Excel preview cache folder is kept before deletion (per previewed version of an Excel document). |
igrafx.caching.cleanup.excel.initialdelay | 10000 (ms) | System property or igrafx.properties | How long after startup the Excel preview cache cleanup waits before its first run. |
igrafx.caching.cleanup.excel.fixeddelay | 86400000 (ms) | System property or igrafx.properties | How long the Excel preview cache cleanup waits between runs. |
igrafx.caching.enterprisemodel.timestamp.persistFrequencySeconds | 30 (s) | System property or igrafx.properties (18.2.4 and later) | Seconds between writing the latest enterprise-model change timestamp to the database. |
igrafx.security.csrf.clientunprotected | false | System property (17.2.1 and later) or igrafx.properties (17.2.3 and later) | Disables CSRF protection for endpoints used by the iGrafx Desktop Client. Use only for desktop clients 17.2.0 or earlier connecting to a 17.2.1+ platform, until all clients are upgraded — then re-enable. false = protection on, true = protection off. |
igrafx.upload.maxfilesize | 1073741824 (bytes) / 1 GB | System property | Maximum size of a single file upload. |
igrafx.upload.maximagefilesize | 1048576 (bytes) / 1 MB | System property | Maximum size of an image added to a repository (should never exceed igrafx.upload.maxfilesize). |
igrafx.upload.maxrequestsize | 1073741824 (bytes) / 1 GB | System property | Maximum size of an entire upload request. |
igrafx.upload.filesizethreshold | 2097152 (bytes) / 2 MB | System property | Size threshold after which uploaded files are written to disk. |
igrafx.modeling.hideautomaticrelationships | false | System property (17.2.1 and later) | Whether the platform hides relationships created automatically from desktop-client diagrams (based on the containing diagram and swimlane). Automatic relationships still appear in the iGrafx Desktop Client. |
igrafx.usercentral.saml.locallogin | false | System property or igrafx.properties | Behavior of the default login form under SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO.. false = no login form when SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. is enabled. true = login works at /Login but other entry points forward to the SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. IdP (not recommended permanently — SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials. session timeouts redirect to the platform login rather than the IdP). primary = the login form is the default, and SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. is used only when IdP-initiated. |
igrafx.usercentral.saml.maxauthenticationage | 7200 (s) | System property or igrafx.properties | Maximum age, in seconds, of a SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. assertion's authentication statement. Defaults to two hours; raise it for IdPs whose statements stay valid for longer (for example Microsoft Azure Active Directory / Office 365 and Google). |
igrafx.usercentral.ldap.forceuuidretrieval | false | System property | For non–Active Directory user directories, forces use of a binary UUID attribute (named by igrafx.usercentral.ldap.uuidcolumn) to identify users and groups across synchronizations. |
igrafx.usercentral.ldap.uuidcolumn | objectGUID | System property | The LDAP attribute used to identify users across synchronizations — a binary attribute that doesn't change over time. Active Directory uses objectGUID by default; if it's absent, the platform falls back to the DN (groups) or login-name attribute (users). For a non-AD directory, enable igrafx.usercentral.ldap.forceuuidretrieval. |
igrafx.usercentral.session.timeout | 60 | System property (18.4.0 and later) | Default session timeout in minutes of inactivity. Doesn't affect connected OAuth/SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. session timeouts, which are configured separately. Before 18.4.0, see Changing the default session timeout of the iGrafx platform. |
igrafx.restapi.enabled | false | UI, system property, or igrafx.properties | Enables the REST API. When false, no API calls are possible and some extensions stop working. Use only if the toggle in Administration → Support → REST API isn't available. |
igrafx.restapi.enabled.basicauth | false | UI, system property, or igrafx.properties | Enables Basic authentication for the REST API. Works only when the REST API is enabled. Use only if the Administration → Support → REST API toggle isn't available. |
igrafx.restapi.enabled.apikey | false | UI, system property, or igrafx.properties | Enables API-key authentication for the REST API. Works only when the REST API is enabled. Use only if the Administration → Support → REST API toggle isn't available. |
igrafx.auditing.loginevents | false | UI, system property, or igrafx.properties | Enables audit-data logging. Setting true overrides the Audit information about successful logins toggle, under Audit Settings on Administration → Support → System Information. |
igrafx.auditing.expiration.threshold | 7776000 (s) | System property or igrafx.properties | Seconds after which existing audit data is deleted. Defaults to 90 days. |
igrafx.auditing.localfile.maxsize.mb | 10 (MB) | System property | Size at which the on-premises enhanced audit log files roll over. Files roll over by size only, never by date. |
igrafx.approvalstate.update.delay | 60000 (ms) | System property or igrafx.properties | Milliseconds between checks for scheduled effective dates of approved objects. |
igrafx.defaults.locale | unset | System property | Default locale in language_COUNTRY form (for example en_US). Used when the user's locale can't be determined — for example, the email-notification language for users set to auto-detect. |
igrafx.database.jdbc.url.* | unset | System property (17.4.2 and later) | Overrides the JDBC URL used to connect to a database; create one property per connection. The exact name depends on how the database was configured. MS SQL: igrafx.database.jdbc.url.%HOSTNAME%, …%HOSTNAME%.%DATABASE_NAME%, or …%HOSTNAME%.%INSTANCE_NAME%.%DATABASE_NAME% (for example igrafx.database.jdbc.url.myhostname.mydatabasename). Oracle: igrafx.database.jdbc.url.%HOSTNAME%.%SID%.%SCHEMA%. |
igrafx.database.batchsize | 50 | System property (17.6.1 and later) | Custom properties processed per batch when loading the Item Properties page. |
igrafx.object.copy.delay | 50 (ms) | System property (17.6.2 and later) | Milliseconds between each object when copying multiple objects. |
igrafx.global.customemailtemplates.disabled | false | System property (17.6.2 and later) | When true, administrators can't change the email templates (the customized templates are still used). Future changes require a platform restart with the value set back to false. |
igrafx.please.wait.delay | 1500 (ms) | System property (17.6.2 and later) | Milliseconds before the "Please wait" screen appears for a long-running operation. |
igrafx.upload.fileextensionsallowed | All file types allowed | System property or igrafx.properties (17.6.2 and later) | Comma-separated allowlist of file extensions permitted for external files. Don't add spaces or leading dots. Example: igrafx.upload.fileextensionsallowed=jpg,jpeg,png,gif,txt,doc,docx,pdf. |
igrafx.security.corsorigins | not set | System property or igrafx.properties (17.6.2 and later) | Comma-separated list of origins allowed to make cross-origin (CORS) requests to the API. By default only the platform itself can. Include protocol and port where relevant, or set * to allow any domain. Example: igrafx.security.corsorigins=https://app1.acmecorp.com,http://spa.acmecorp-internal.net:8080. |
igrafx.approval.showdiff | true | System property (17.7.0.756 and later) | Whether initiating an approval-cycle vote shows the table highlighting differences from the previously approved version. |
igrafx.security.rejectmsofficelinks | true | System property (17.7.1 and later) | Rejects requests from Microsoft Office link-scanning so links followed from Office documents don't land on the login page. Set false to restore default link behavior. |
igrafx.cycle.poolsize | 10 | System property (17.7.0.759 and later) | Concurrent jobs the cycle scheduler runs at once. Lower it if automatic cycles or reminders fail with deadlocks under high volume. |
igrafx.sql.retrycount | 15 | System property (17.7.0.759 and later) | Times to retry a deadlocked action. Each retry waits a random period between igrafx.backoff.minperiod and igrafx.backoff.maxperiod. |
igrafx.backoff.minperiod | 50 (ms) | System property (17.7.0.759 and later) | Minimum wait before retrying a deadlocked transaction. |
igrafx.backoff.maxperiod | 3000 (ms) | System property (17.7.0.759 and later) | Maximum wait before retrying a deadlocked transaction. |
igrafx.autocomplete.maxresults | 250 | System property (17.7.2 and later) | Maximum autocomplete results returned at once. |
igrafx.email.max.recipients | 100 | System property (17.7.2 and later) | Maximum recipients on a single email — applies to BCC recipients on bulk emails. |
igrafx.cyclegroup.pendingvotermax | 250 | System property (17.7.2 and later) | Pending voters that cycle permission checks run on before the Cycle Manager is prompted to check permissions separately. |
igrafx.cyclegroup.cycleparticipantmax | 25 | System property (17.7.2 and later) | Cycle participants shown in the Cycle log and Historical Cycle log for review, approval, and endorsement cycles before the information becomes a paginated report. |
igrafx.defaults.newuserlocale | false | System property | Suppresses the first-login (and post-upgrade) locale selection so users keep their original locale choice. |
igrafx.usercentral.saml.metadataurl | unset | System property | The SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. metadata URL. Accepts http or https URLs only — file:/// URLs don't work. |
igrafx.usercentral.saml.metadatarefreshinterval | 1800000 (ms) | System property (20.2 and later) | Milliseconds between automatic downloads of the SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. identity provider metadata when it's configured as a URL. Metadata uploaded as a file isn't reloaded. |
igrafx.mail.aggregator.schedule | 0 5 0 * * * | System property (17.8.4 and later) | Cron schedule (standard cron format) for how often aggregate cycle-reminder emails are sent. Defaults to once a day, shortly after midnight (00:05). |
Related
- Installation and base directories — where
igrafx.propertieslives - Configuring authentication
- File-based audit logging