XCreds

com.twocanoes.xcreds

XCreds 5.9 (9148) OAuth Settings

macOS

Configuration Keys (124)

Showing 124 of 124 keys

Key	Type	Description	Default	Range
`ADDomain`string ADDomain	string	The desired AD domain	Default: —	Range: —
`mapKerberosPrincipalName`string Map Kerberos Principal Name	string	The OIDC claim that has the kerberos principal name. This is used when logging in with OIDC and ADDomain is defined. During login, the claim that contains the kerberos principal name will be read and the local account will set dsAttrTypeNative:_xcreds_activedirectory_kerberosPrincipal to the kerberos principal name. The menu item will then use this value and the password to get a kerberos ticket.	Default: —	Range: —
`shouldUpdateKerberosUserPrincipalADDomain`boolean Should Update Kerberos User Principal ADDomain	boolean	If the user principal has a domain name and the OpenID token does not match the ADDomain name, replace it with the ADDomain name. For example: bob@sub.example.com -> bob@example.com if ADDomain was example.com.	Default: false	Range: —
`clientID`string Client ID	string	The OIDC client id public identifier for the app.	Default: —	Range: —
`clientSecret`string Client Secret	string	Client Secret sometimes required by identity provider.	Default: —	Range: —
`CreateAdminUser`boolean Create User as Admin	boolean	When set to true and the user account is created, the user will be a local admin.	Default: false	Range: —
`skipUserSetupBuddy`boolean Skip User Setup Buddy	boolean	When set to true and a new user home is created, the .skipbuddy file will be created at the top of the home folder to skip user setup screens.	Default: false	Range: —
`allowUsersClaim`string Allow Users Claim	string	The claim that contains the value to check for in the allowedUsersArray. Both must be defined.	Default: "upn"	Range: —
`allowedUsersArray`array Allowed Users	array	List of users that are allowed to log in. An empty array or undefined array means any user can log in as long their cloud credentials are valid. The preference allowUsersClaim must be defined to a claim in the idToken that identifies the users. For example, if the allowUsersClaim is set to upn and the allowedUsersArray is set to an array that contains fred@twocanoes.com and the upn of a logging in user is fred@twocanoes.com, they would be allowed to log in. barney@twocanoes.com would not.	Default: —	Range: —
`user`string	string	—	Default: —	Range: —
`allowLoginIfMemberOfGroup`array Allow Login If Member Of Group	array	(OIDC Only) List of groups whose members should be allowed to login. If the user is a member of any of these groups they can login regardless (including creating new local account) if authorization succeeds. If a local account exists but the user is no longer part of a group the login will be denied.	Default: —	Range: —
`group`string	string	—	Default: —	Range: —
`CreateAdminIfGroupMember`array Create Admin If Group Member	array	List of groups that should have members be given local administrator status. Local administrator status can be given on first authentication when account created, or on later sign in of existing user when a group member. Administrator status is removed if group membership later revoked. Administrator status is not removed if user is the only XCreds admin user. Set as an Array of Strings of the group identifier.	Default: —	Range: —
`group`string	string	—	Default: —	Range: —
`claimsToAddToLocalUserAccount`array Claims To Add To Local User Account	array	List of claims that should be added to the user local account. Will be prefixed with _xcreds_oidc_. Set as an Array of Strings of the claim.	Default: —	Range: —
`claim`string	string	—	Default: —	Range: —
`systemInfoAdditionsArray`array System Info Additions	array	Items to be added to the System Info Popover at login. Can be made dynamic by using the override script override to provide this setting	Default: —	Range: —
`item`string	string	—	Default: —	Range: —
`shouldSwitchToLoginWindowWhenLocked`boolean Should Switch To Login Window When Locked	boolean	When set to true and the user locks the current session, XCreds will tell the system to switch to Login Window. The current session will stay active but the user will login with the XCreds Login Window to resume the session.	Default: false	Range: —
`LocalFallback`boolean LocalFallback	boolean	If the user attempts to login as an AD user and the login fails against AD, try against local user account if off domain or AD user not found.	Default: false	Range: —
`shouldActivateSystemInfoButton`boolean Should Activate System Info Button	boolean	Show the system info popover as active when first starting	Default: true	Range: —
`discoveryURL`string Discovery URL	string	The discovery URL provided by your OIDC / Cloud provider. For Google it is typically https://accounts.google.com/.well-known/openid-configuration and for Azure it is typically https://login.microsoftonline.com/common/.well-known/openid-configuration.	Default: "https://login.microsoftonline.com/common/.well-known/openid-configuration"	Range: —
`EnableFDE`boolean Enable Full Disk Encryption (FDE)	boolean	Enabled FDE enabled at first login on APFS disks.	Default: false	Range: —
`EnableFDERecoveryKey`boolean Save PRK	boolean	Save the Personal Recovery Key (PRK) to disk for the MDM Escrow Service to collect.	Default: false	Range: —
`EnableFDERecoveryKeyPath`string FDE Recovery Key Path	string	Specify a custom path for the recovery key.	Default: —	Range: —
`EnableFDERekey`boolean Enable FDE Rekey	boolean	Rotate the Personal Recovery Key (PRK).	Default: false	Range: —
`loginWindowWidth`integer Login Window Width	integer	Login Window webview width (Integer). If this is not defined, it will be full width. Minimum value of 150.	Default: —	Range: 150 – —
`loginWindowHeight`integer Login Window Height	integer	Login Window webview height (Integer). If this is not defined, it will be full height. Minimum value of 150.	Default: —	Range: 150 – —
`loadPageTitle`string LoadPage Title	string	When no network connection or a profile is not defined, this title is shown in an HTML view to the user when cloud login is configured.	Default: "Please Wait...."	Range: —
`loadPageInfo`string LoadPage Info	string	When no network connection or a profile is not defined, this text is shown in an HTML view to the user when cloud login is configured.	Default: "(or try connecting to network or check preferences)"	Range: —
`shouldHideLoginWindowLogo`boolean should Hide Login Window Logo	boolean	Hide the login window logo.	Default: false	Range: —
`loginWindowLogoPath`string Login Window Logo Path	string	URL to an image to show icon in the username / password login window	Default: —	Range: —
`loginWindowBackgroundImageURL`string Login Window Background Image URL	string	URL to an image to show in the background while logging in. Default value: file:///System/Library/Desktop Pictures/Monterey Graphic.heic.	Default: "file:///System/Library/CoreServices/DefaultDesktop.heic"	Range: —
`loginWindowBackgroundImageAlpha`real Login Window Background Image Alpha	real	Alpha value of loginWindowBackgroundImage. Default value: 1	Default: 1	Range: 0 – 1
`loginWindowSecondaryMonitorsBackgroundImageURL`string Login Window Secondary Monitors Background Image URL	string	URL to an image to show in the background on secondary display while logging in. Default value: file:///System/Library/Desktop Pictures/Monterey Graphic.heic.	Default: "file:///System/Library/CoreServices/DefaultDesktop.heic"	Range: —
`menuItemIconData`data Menu Item Icon Data	data	Base64 data of icon. Should be 48 x 48.	Default: —	Range: —
`menuItemIconCheckedData`data Menu Item Icon Checked Data	data	Base64 data of icon with checkmark. Should be 48 x 48.	Default: —	Range: —
`menuItemWindowBackgroundImageURL`string Menu Item Window BackgroundImageURL	string	URL to an image to show in the background of the window that appears when logged in and prompting for Active Directory username and password.	Default: —	Range: —
`menuItemWindowBackgroundImageAlpha`real Menu Item Background Image Alpha	real	Alpha value of menuItemWindowBackgroundImageURL. Default value: 1	Default: 1	Range: 0 – 1
`shouldLoginWindowBackgroundImageFillScreen`boolean Login Window Background Image Fill Screen	boolean	Set the background image to Fill Screen rather than Fit to Screen	Default: true	Range: —
`shouldLoginWindowSecondaryMonitorsBackgroundImageFillScreen`boolean Login Window Secondary Monitors Background Image Fill Screen	boolean	Set the secondary monitor(s) background image to Fill Screen rather than Fit to Screen	Default: true	Range: —
`loginWindowSecondaryMonitorsBackgroundAlpha`real Login Window Secondary Monitors Background Image Alpha	real	Alpha value of loginWindowSecondaryMonitorsBackground. Default value: 1	Default: 1	Range: 0 – 1
`shouldRemoveMenuItemAutoLaunch`boolean Should Remove Menu Item Auto Launch	boolean	When XCreds is installed, a launch agent is installed to automatically keep the menu item running when a user is logged in. Setting shouldRemoveMenuItemAutoLaunch to true makes XCreds at the login window remove the launchagent plist that was installed. This will cause the launchagent to not launch XCreds menu item on log in.	Default: false	Range: —
`shouldUseADNativePasswordChangeMenuItem`boolean Should Use AD Native Password Change Menu Item	boolean	When changing password via menu item, use the native UI to change password in Active Directory.	Default: false	Range: —
`passwordChangeURL`string Password Change URL for Menu	string	Add a menu item for changing the password that will open this URL when the menu item is selected. If shouldUseADNativePasswordChangeMenuItem is set to true, this value is not used.	Default: —	Range: —
`redirectURI`string Redirect URI	string	The URI passed back to the webview after successful authentication. Default value: xcreds://auth/	Default: "xcreds://auth/"	Range: —
`shouldShowCloudLoginByDefault`boolean Show Cloud Login By Default	boolean	Determine if the Mac login window or the cloud login window is shown by default. When not set or set to true, show cloud login. If false, shows Mac login.	Default: true	Range: —
`refreshRateHours`integer Password Change Check Rate Hours	integer	The number of hours between checks. Default value: 3. Minimum value: 0. Max value: 168.	Default: 3	Range: 0 – 168
`refreshRateMinutes`integer Password Change Check Rate Minutes	integer	The number of minutes between checks. Default value: 0. Minimum value: 0. Max value: 59. This value is added to refreshRateHours. If refreshRateHours is 0, minimum for refreshRateMinutes becomes 5.	Default: 0	Range: 0 – 59
`scopes`string Scopes	string	Scopes tell the identify provider what information to return. Note that the values are provided with a single space between them. Provide the following values the follow IdPs: Google: profile openid email Azure: profile openid offline_access Note that Google does not support the offline_access scope so instead use the preference shouldSetGoogleAccessTypeToOffline. Azure provides unique_name which is mapped to the local user account by using the prefix before "@" in unique_name and matching to the short name of a user account. Google provides "email" and is matched in the same way.	Default: "profile openid offline_access"	Range: —
`shouldSetGoogleAccessTypeToOffline`boolean Request Google Refresh Token	boolean	When using Google IdP, a refresh token may need be requested in a non-standard way.	Default: false	Range: —
`googleHostDomain`string Google Host Domain	string	When using Google IdP, set the HD key to show the user's domain	Default: —	Range: —
`shouldPromptForADPasswordChange`boolean Should Prompt For AD Password Change	boolean	If the domain controller returns back that the password is expired or needs to be changed, prompt the user. If this is set to false, login will fail and an error message will be shown.	Default: true	Range: —
`shouldShowSignInMenuItem`boolean Show Sign In Menu Item	boolean	Determine if the Sign In menu item is shown in the XCreds menu. When not set or set to true, show Sign In. If false, the Sign In menu item is hidden.	Default: true	Range: —
`shouldSuppressLocalPasswordPrompt`boolean Should Suppress Local Password Prompt	boolean	Do not prompt for local password.	Default: false	Range: —
`shouldPreferLocalLoginInsteadOfCloudLogin`boolean Prefer Local Login over Cloud Login	boolean	Favor using XCreds' local login screen over the cloud login UI.	Default: false	Range: —
`shouldVerifyPasswordWithRopg`boolean Use ROPG when testing password	boolean	(Deprecated in v4.0) When verifying password in the menu app, use ROPG.	Default: false	Range: —
`shouldUseBasicAuthWithROPG`boolean Should Use Basic Auth With ROPG	boolean	When using ROPG, do basic HTTP auth. Default: false	Default: false	Range: —
`ropgClientID`string ROPG Client ID	string	(Removed in v4.0) ROPG Client ID for use when checking password.	Default: —	Range: —
`ropgClientSecret`string ROPG Client Secret	string	(Removed in v4.0) ROPG Client Secret for use when checking password.	Default: —	Range: —
`shouldUseROPGForLoginWindowLogin`boolean Use ROPG when logging in at login window	boolean	When verifying password in the login window, use ROPG.	Default: false	Range: —
`shouldUseROPGForMenuLogin`boolean Use ROPG for menu login	boolean	When verifying password in the menu app, use ROPG.	Default: false	Range: —
`shouldUseROPGForPasswordChangeChecking`boolean Should Use ROPG For Password Change Checking	boolean	When verifying local password matches cloud password in the background, use ROPG. If set to false, the refresh token will be used to verify password change.	Default: false	Range: —
`shouldUseLDAPForPasswordChangeChecking`boolean Should Use LDAP For Password Change Checking	boolean	When verifying local password matches cloud password in the background, use Google LDAP. If set to false, the refresh token will be used to verify password change.	Default: false	Range: —
`resource`string ROPG Resource	string	Resource URL when using ROPG. Typically needed only for Azure. Common value is https://graph.microsoft.com	Default: —	Range: —
`ropgResponseValue`string ROPG Response Value	string	When a ROPG request is completed successfully to verify password, it may return an error that two factor is required. Add the string that is returned for the JSON response. For Azure, it is typically interaction_required. For Okta, the response is usually {"error":"invalid_grant","error_description":"Resource owner password credentials authentication denied by sign on policy."} Can be a string or an array of strings.	Default: "interaction_required"	Range: —
`hideIfPathExists`string Hide If Path Exists	string	Don't show the UI if this key is defined and a file or folder exists at this path.	Default: —	Range: —
`aliasName`string Alias Name	string	Name of OIDC claim that contains an alias to add to a user account. Usually this is the "upn" (eg syd@twocanoes.com) so the user can log in at the standard login window the same as the IdP login window. Adds the value to record name of the user account as an alias.	Default: —	Range: —
`autoRefreshLoginTimer`integer Automatically Refresh Login Window (seconds)	integer	Timer for automatically refreshing login screen in seconds. If set to 0, does not automatically refresh.	Default: 0	Range: —
`cloudLoginText`string Cloud Login Text	string	Text for return to cloud login on Mac login screen	Default: "Cloud Login"	Range: —
`shouldShowAboutMenu`boolean Show About Menu	boolean	Show the About Menu item menu. Default value: true	Default: true	Range: —
`shouldSkipFileVaultLogin`boolean Skip FileVault Login	boolean	Skip FileVault login during startup if FileVault is enabled. The current username and password are used to tell fdesetup to silently use the credentials during next reboot to unlock FileVault. Passthrough is also disabled and the user will see the XCreds Login Window. To avoid the user being prompted for admin credentials, set the "Login And Background Item Management" management item (com.apple.servicemanagement) to allow teamid UXP6YEHSPW to have background tasks.	Default: false	Range: —
`shouldSkipFileVaultLoginAdmin`boolean Skip FileVault Login as Admin	boolean	Skip FileVault authentication at startup if FileVault is enabled. The admin credentials will be used to tell fdesetup to silently use the credentials during next reboot to unlock FileVault. Passthrough is also disabled and the user will see the XCreds Login Window. To avoid the user being prompted for admin credentials, set the "Login And Background Item Management" management item (com.apple.servicemanagement) to allow teamid UXP6YEHSPW to have background tasks. Default value: false	Default: false	Range: —
`shouldShowMenuBarSignInWithoutLoginWindowSignin`boolean Should Show Menu Bar Sign In Without Login Window Sign In	boolean	If the discovery URL is defined and there are no tokens or tickets, the sign in window in the user session will show even if the user did not log in from the XCreds Login Window	Default: false	Range: —
`refreshBannerText`string Refresh Banner Text	string	Text at top of window shown in user session when prompting for password.	Default: "Log in to verify your cloud credentials. After verification, your local user account password will be set to your cloud password."	Range: —
`shouldShowRefreshBanner`boolean Show Refresh Banner	boolean	Show text at the top of the prompt window when tokens expire.	Default: true	Range: —
`shouldShowConfigureWifiButton`boolean Show Configure WiFi	boolean	Show Configure WiFi button in XCreds Login.	Default: true	Range: —
`shouldShowShutdownButton`boolean Show Shutdown Button	boolean	Show Shutdown button in XCreds Login.	Default: true	Range: —
`shouldShowRestartButton`boolean Show Restart Button	boolean	Show Restart button in XCreds Login.	Default: true	Range: —
`shouldShowSystemInfoButton`boolean Show System Info Button	boolean	Show Configure System Info in XCreds Login.	Default: true	Range: —
`shouldShowPreferencesOnStart`boolean Show Preferences on Startup	boolean	Show Settings on start if none are defined. Default value: false	Default: false	Range: —
`shouldPromptForMigration`boolean Should Prompt for Migration	boolean	Prompt for local account username and password if no account was mapped and there are standard users already on the system.	Default: false	Range: —
`shouldAllowKeyComboForMacLoginWindow`boolean Should Allow Key Combo For Mac Login Window	boolean	Allow key combo (control-option return) to switch logon window. Use command-option-control-return for Mac Login Window.	Default: false	Range: —
`keyCodeForLoginWindowChange`integer Key Code For Login Window Change	integer	key code for shouldAllowKeyComboForMacLoginWindow. If not defined, it is return or enter. If this is defined, this key is used with control-option to switch to login window and command-option-control and this key is used to switch to Mac Login Window. Uses CGKeyCode (for example, enter is 76 and return is 36)	Default: —	Range: —
`shouldShowMacLoginButton`boolean Show Mac Login Window button	boolean	Show the Mac Login Window button in XCreds Login.	Default: true	Range: —
`shouldShowLocalOnlyCheckbox`boolean Show Local Only Checkbox	boolean	Show the local only checkbox on the local login page	Default: true	Range: —
`usernamePlaceholder`string Username Placeholder Text	string	Placeholder text in local / AD login window for username	Default: —	Range: —
`passwordPlaceholder`string Password Placeholder Text	string	Placeholder text in local / AD login window for password	Default: —	Range: —
`shouldShowSupportStatus`boolean Show Support Status Message	boolean	Show message in XCreds Login reminding people to buy support.	Default: true	Range: —
`shouldShowQuitMenu`boolean Show Quit Menu Item	boolean	Show Quit in the menu item menu. Default value: true	Default: false	Range: —
`shouldShowVersionInfo`boolean Show Version and Build Number	boolean	(Removed in v5.4 and replaced by shouldActivateSystemInfoButton) Show the version number and build number in the lower left corner of XCreds Login.	Default: true	Range: —
`showDebug`boolean Show Debug Message	boolean	Show push notifications for authentication progress. Default value: false	Default: false	Range: —
`username`string Local Username	string	When a user uses cloud login, XCreds will try and figure out the local username based on the email or other data returned for the IdP. Use this value to force the local username for any cloud login. Provide only the shortname.	Default: —	Range: —
`KeychainReset`boolean Keychain Reset	boolean	When a local user password does not match the cloud or AD password, this key will allow the user to select a Reset button to set their password to match their AD/cloud password, move their current keychain aside and create a new keychain. If XCreds does not have access to local admin credentials set from the XCreds command line tools, the user will prompted to enter local admin credentials.	Default: false	Range: —
`PasswordOverwriteSilent`boolean Overwrite Password Silently	boolean	Update the local user password silently to match the cloud / AD password. Requires access to admin credentials. See command line help to set admin username and password.	Default: false	Range: —
`HideExpiration`boolean Hide Expiration	boolean	Hide AD Expiration even if defined in AD Account	Default: false	Range: —
`localAdminUserName`string Local Admin User Name	string	Username of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to setup a secure token for newly created users.	Default: —	Range: —
`localAdminPassword`string Local Admin Password	string	Password of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to setup a secure token for newly created users.	Default: —	Range: —
`accountLockedPasswordDialogTitle`string Account Locked Password Dialog Title	string	Title of dialog prompting user to enter in their prior local password when account is locked.	Default: "Unlock Account"	Range: —
`shouldSkipSettingSecureTokenForAdmin`boolean Should Skip Setting Secure Token For Admin	boolean	Skip setting a secure token for the local admin user specified in XCreds. The token will be attempted if the local admin does not already have a secure token and a boot strap token is available.	Default: false	Range: —
`shouldHideSecureTokenStatus`boolean Should Hide SecureToken Status	boolean	Hide the status of SecureToken users in the popover status view	Default: false	Range: —
`accountLockedPasswordDialogText`string Account Locked Password Dialog Text	string	Text of dialog prompting user to enter in their prior local password when account is locked.	Default: "The user account is locked. You can wait for the account to unlock or reset the password by clicking the Reset button below."	Range: —
`resetPasswordDialogTitle`string Reset Password Dialog Title	string	Title of dialog prompting user to enter in their prior local password.	Default: "Please enter your local login password to sync your cloud password and login."	Range: —
`systemInfoButtonTitle`string System Info Button Title	string	The title of the button for system info in the bottom right corner of the login screen. This can either be plain text or one of these special values: .os, .hostname, .ipaddress, .serial, .mac, .computername, .ssid. Using the special value will populate the associated information as the button title.	Default: "System Info"	Range: —
`verifyPassword`boolean Verify Cloud Password	boolean	When cloud password is changed and the local keychain password and local user account needs to be changed, a verification dialog can be shown to verify the password. Default value: true	Default: true	Range: —
`shouldDetectNetworkToDetermineLoginWindow`boolean Should Detect Network To Determine Login Window	boolean	Check if network is up. If not, select username and password login window.	Default: false	Range: —
`idpHostName`string IDP Host Name	string	Hostname of the page that has the password field. When the user submits the form, XCreds will use idpHostName to identify a page it needs to look for the password field. The password value is identified by an HTML id defined by passwordElementID. If this value is not defined. XCreds will look for login.microsoftonline.com and accounts.google.com. This value is commonly set for other IdP’s and for Azure environments that use ADFS.	Default: —	Range: —
`idpHostNames`array IDP Host Names	array	array of hostnames of the page that has the password field.	Default: —	Range: —
`idpHostName`string	string	—	Default: —	Range: —
`AdditionalADDomains`array Additional AD Domains	array	array of additional AD domains to accept	Default: —	Range: —
`Domain`string	string	—	Default: —	Range: —
`ccidSlotName`string CCID Slot Name	string	Name of slot for CCID reader for reading RFID cards	Default: —	Range: —
`shouldAllowLoginCardSetup`boolean Should Allow Login Card Setup	boolean	If an unknown RFID card is tapped, show option to pair with local account.	Default: true	Range: —
`adUserAttributesToAddToLocalUserAccount`array AD User Attributes To Add To Local User Account	array	array of AD user attributes to add to local directory user account	Default: —	Range: —
`userAttribute`string	string	—	Default: —	Range: —
`passwordElementID`string Password Element ID	string	Password element id of the html element that has the password. It is read by using JavaScript to get the value (for example, for Azure, the JavaScript document.getElementById('i0118').value is sent. If this default is not set, standard values for Azure and Google Cloud will be used. To find out this value, use a browser to inspect the source of the page that has the password on it. Find the id of the textfield that has the password. Fill in the password and then open the JavaScript console. Run: document.getElementById('passwordID').value changing "passwordID" to the correct element ID. If the value you typed into the textfield is returned, this is the correct ID.	Default: —	Range: —
`map_firstname`string First Name OIDC Mapping/AD Attribute	string	Local DS to OIDC/AD Mapping for First Name. Default value: "given_name" (OIDC), "givenName" (AD). map_firstname should be set to an OIDC claim/AD Attribute for first name.	Default: "given_name"	Range: —
`map_lastname`string Last Name OIDC Mapping	string	Local DS to OIDC/AD Mapping for Last Name. Default value: "family_name" (OIDC), "sn" (AD). map_lastname should be set to an OIDC claim for last name.	Default: "family_name"	Range: —
`map_fullname`string Full Name OIDC Mapping/AD Attribute	string	Local DS to OIDC/AD Attribute Mapping for Full Name. Default value: "name"(OIDC), "displayName" (AD). map_fullname should be set to an OIDC claim/AD Attribute for full name.	Default: "name"	Range: —
`map_username`string Username OIDC Mapping/AD Attribute	string	Local DS to OIDC Mapping/AD Attribute for Name. Default value: "name" (OIDC), "userPrincipalName" (AD). map_username should be set to an OIDC claim/AD Attribute for name. The macOS username will be set as the portion of this value before an @ symbol if present.	Default: "name"	Range: —
`map_fullusername`string Full Username OIDC Mapping/AD Attribute	string	Local DS to OIDC Mapping for Full Username (for example, freddy@twocanoes.com) Default value: "unique_name". map_username should be set to an OIDC claim for full username.	Default: "name"	Range: —
`map_uid`string Map UID	string	Local DS to OIDC Mapping/AD Attribute for UID at initial user creation. If not set, the uid will be set to the next available. If the mapped UID is used, login will fail.	Default: —	Range: —
`primaryGroupID`string Primary Group ID	string	Primary Group ID when creating a new user. Default value 20.	Default: "20"	Range: —
`map_password_expiry`string Map OIDC claim to Password Expiry in Seconds	string	Password expiry mapping to claim. If this value is set to an OIDC claim, the value in that claim should be the number of seconds from the token issued time (iat) to the expiry date.	Default: "pwd_exp"	Range: —
`settingsOverrideScriptPath`string Override Script Path	string	Script to override defaults. Must return valid property list with specified defaults. Script must exist at path, be owned by _securityagent and writable and executable only by _securityagent.	Default: "name"	Range: —
`upnSuffixToDomainMappings`array UPN Suffix To Domain Mappings	array	In some Active Directory environments, users do not use username@domain to login; they use a UPN suffix to make the username easier to use. This setting maps the UPN suffix to the correct AD domain name. For example, if you have an AD domain of foo.com but want users to sign in as user@bar.com, a UPN suffix of foo.com is created in AD and the user account is set to user@foo.com. This setting then would map foo.com to bar.com by setting the key upn to foo.com and the domain key to bar.com.	Default: —	Range: —
dict	dict	—	Default: —	Range: —
`upn`string UPN	string	UPN	Default: —	Range: —
`domain`string domain	string	domain	Default: —	Range: —
`menuItems`array Menu Items	array	Menu Items	Default: —	Range: —
`menuItemName`dict Optional Menu Items required	dict	Menu Item Name	Default: —	Range: —
`menuItemName`string Menu Item Name required	string	Menu Item	Default: —	Range: —
`linkOrAppPath`string Web page URL or local path to app required	string	Link or App Path	Default: —	Range: —
`separatorBefore`boolean Separator Before	boolean	Separator line before menu item	Default: false	Range: —
`separatorAfter`boolean Separator After	boolean	Separator line after menu item	Default: false	Range: —
`Shares`array Shares	array	Add menu item and mount/automount shares	Default: —	Range: —
dict	dict	—	Default: —	Range: —
`Name`string Name	string	Name of share to show in menu	Default: —	Range: —
`URL`string URL	string	URL for share (eg smb://server.example.com/share)	Default: —	Range: —
`Groups`array Groups	array	—	Default: —	Range: —
`ConnectedOnly`boolean ConnectedOnly	boolean	Allow mounting only if network connection is detected	Default: —	Range: —
`AutoMount`boolean AutoMount	boolean	Automatically mount when XCreds starts	Default: —	Range: —
`HomeMountEnabled`boolean Home Mount Enabled	boolean	Show and mount home directory from AD profile if defined.	Default: true	Range: —
`HomeAppendDomain`boolean Home Append Domain	boolean	Append the domain name to the share defined in the profile.	Default: false	Range: —
`shareMenuItemName`string Share Menu Item Name	string	Name for Shares menu item. Default: "Shares".	Default: —	Range: —
`shouldAllowEmptyLocalPassword`boolean Should Allow Empty Local Password	boolean	Allow local user with empty password to log in	Default: false	Range: —