Skip to content

Janssen Documentation

Properties

FIDO2 Server Configuration#

This document contains a detailed reference of configuration properties. To learn how to safely update these dynamic configuration parameters, please follow the Janssen FIDO2 Configuration Guide first.

FIDO2 Server Configuration Parameters#

The following properties represent the dynamic configuration for the Janssen FIDO2 Server. They are stored in the configuration storage layer and can be updated at runtime.

Field Name	Type / Example	Description
`issuer`	`https://my-jans-server.jans.io`	URL using the HTTPS scheme with no query or fragment component. The OP asserts this as its Issuer Identifier.
`baseEndpoint`	`https://my-jans-server/jans-fido2/restv1`	Base URL of the FIDO2 server endpoints.
`webAuthnEndpoint`	`https://my-jans-server/jans-fido2/restv1/webauthn/configuration`	Base URL of the FIDO2 WebAuthn Server Endpoint which returns Relying Party (RP) Origins.
`cleanServiceInterval`	`60`	Time interval for the Clean Service daemon in seconds.
`cleanServiceBatchChunkSize`	`10000`	Number of expired records fetched and deleted per iteration batch from the persistence store.
`useLocalCache`	`true`	Boolean value specifying whether to enable local in-memory caching for performance.
`disableJdkLogger`	`true`	Boolean value specifying whether to disable standard JDK loggers.
`loggingLevel`	`INFO`, `DEBUG`, or `TRACE`	The logging verbosity level for the FIDO2 server diagnostics.
`loggingLayout`	`text` or `json`	Format of output log lines (plain text layout or structured JSON).
`externalLoggerConfiguration`	String	Path to an external Log4j2 XML configuration file.
`metricReporterInterval`	`300`	The interval for the legacy jans-core metric reporter daemon in seconds.
`metricReporterKeepDataDays`	`15`	The retention period in days for legacy metric reporter records stored in persistence.
`metricReporterEnabled`	`true`	Boolean value specifying whether to enable the legacy jans-core metric reporter.
`fido2MetricsEnabled`	`true`	Master switch for passkey telemetry collection. If `false`, no metric entries are stored. See Passkey Telemetry & Metrics.
`fido2MetricsAggregationEnabled`	`true`	Enables the scheduled hourly/daily/weekly/monthly aggregation jobs for passkey telemetry.
`fido2MetricsAggregationInterval`	`60`	Interval in minutes driving the passkey metrics aggregation scheduler (default `60` = hourly).
`fido2MetricsRetentionDays`	`90`	Retention period in days for passkey metric entries and aggregations before automatic cleanup.
`fido2DeviceInfoCollection`	`true`	Whether device info (browser, OS, device type) is collected and stored with passkey metrics.
`fido2ErrorCategorization`	`true`	Whether passkey operation failures are categorized for the error-analysis endpoint.
`fido2PerformanceMetrics`	`true`	Whether passkey operation durations are tracked for performance analytics.
`fido2Configuration`	Object	Nested object containing FIDO2 protocol-specific details (see structure below).

FIDO2 Configuration Object (`fido2Configuration`)#

This nested block defines WebAuthn and FIDO2 attestation and assertion policy behavior.

Field	Type	Default / Example	Description
`authenticatorCertsFolder`	String	`"/etc/jans/conf/fido2/authenticator_cert"`	Folder where verified authenticator certificates (e.g., Apple roots) are stored.
`mdsCertsFolder`	String	`"/etc/jans/conf/fido2/mds/cert"`	Folder where FIDO Metadata Service (MDS) TOC root certificates are stored.
`mdsTocsFolder`	String	`"/etc/jans/conf/fido2/mds/toc"`	Folder where downloaded MDS TOC files are cached.
`userAutoEnrollment`	Boolean	`false`	Specifies whether to automatically enroll unknown users during WebAuthn cycles (normally disabled).
`unfinishedRequestExpiration`	Integer	`120`	Expiration time in seconds for incomplete registration/authentication requests.
`metadataRefreshInterval`	Integer	`1296000`	Expiration time in seconds (e.g., 15 days) before checking and reloading the FIDO Alliance MDS TOC.
`serverMetadataFolder`	String	`"/etc/jans/conf/fido2/server_metadata"`	Folder where local vendor metadata statement JSON files are placed manually.
`enabledFidoAlgorithms`	Array of Strings	`["RS256", "ES256"]`	Enabled cryptographic signing algorithms allowed for credentials.
`rp`	Array of Objects	`[ { "id": "https://jans.io", "origins": ["jans.io"] } ]`	Relying Party (RP) configuration mapping expected IDs to valid origins.
`metadataServers`	Array of Objects	`[ { "url": "https://mds.fidoalliance.org/" } ]`	External FIDO Metadata Service endpoints to download statement catalogs.
`disableMetadataService`	Boolean	`false`	If set to `true`, the FIDO2 server skips validating authenticators against the MDS3 service.
`mdsDownloadStartupRetries`	Integer	`3`	Number of times the MDS TOC download is retried at server startup when the TOC blob is missing (a missing TOC prevents attestation validation). This is in addition to the initial attempt, so the default of `3` means up to 4 downloads. `0` disables retries. Retries stop early once the blob is present, and are skipped when the metadata server answers HTTP 429, since it has explicitly asked the server to back off.
`mdsDownloadStartupRetryInterval`	Integer	`30`	Delay in seconds between MDS TOC download retries at server startup when the TOC blob is missing.
`hints`	Array of Strings	`["security-key", "client-device", "hybrid"]`	Preferred authenticator type hints presented to the Relying Party.
`enterpriseAttestation`	Boolean	`false`	Enables support for enterprise-specific hardware attestation profiles.
`attestationMode`	String	`"monitor"`	Options are: `disabled` (skip attestation checks), `monitor` (log/validate but allow credentials if attestation is absent/unknown), and `enforced` (fail credential creation if attestation check fails).