Configuring AdminUI | AdminUI Documentation

AdminUI configuration is set using environment variables. These can be setup in different forms, including a web.config file, a docker-compose.yml file or Azure appsettings.

Note: In Azure or IIS environments variables are nested with either __ (Linux environments) or : (Windows environments). E.g: DataProtection:Persistence:Type

Running AdminUI On a Different Port

If you need to configure the ports the UI or API you can add the following section to your appsettings.json files:

  "Kestrel": {
    "Endpoints": {
      "Http": {
        //Your new Url Here
        "Url": "http://localhost:5020"
      }
    }
  }

If you would like to see all possible config options for the Kestrel property you can find them here.

AdminUI Configuration Settings (UI)

Note: In AdminUI 4.2.0 and 5.1.0 onwards, the env.js file is no longer used for configuration and changes do not need to be made to this file. It can be removed if you choose.

AuthorityUrl The IdentityServer installation protecting AdminUI
ApiUrl The AdminUI backend website
UiUrl The AdminUI frontend website
AzureAppServiceLogging (optional) Used for debugging the UI - see the enable logging page for more details.
AdminUIClientSecret The AdminUI client shared secret value in plain text
DataProtection Used for configuration of Cookie protection and peristence.
- Persistence - The type of persistence can be FileSystem or Database, these require different setup as shown below
  - Type - FileSystem
  - Location - Location to persist keys
  - OR
  - Type - Database
  - DbProvider Supported types and their values are:
    - SqlServer
    - MySql (Note: AdminUI requires the MySQL setting lower_case_table_names to be false)
    - PostgreSql
  - DataProtectionConnectionString - The connection string for the data protection database
- Protection The certficate or keyvault that will protect the cookies. The two available types are KeyVault and Certifcate. A Certificate can be provided by location or by thumbprint.
  - Type - KeyVault
  - KeyIdentifier - The Azure KeyVault certificate identifier used for key encryption.
  - ClientId - The Application Client Id
  - Vault - The KeyVault public Uri
  - Secret - (Optional) The client secret to use for authentication. Optional valid only for Azure hosted scenarios
  - OR
  - Type - Certificate (To protect with certificate you can provide either a thumbprint or a location)
    - CertificateType - Thumbprint
    - Thumbprint - The thumbprint of the certficate that is installed either for the user or the machine.
    - OR
    - CertificateType - File
    - Location - The location on disk of the certificate
    - Password (Optional) - The password for the certificate

Filesystem data protection and persistence is intended for IIS installations - we recommend a using the KeyVault method for protection alongside a database for persistence and protection when installing AdminUI in Azure.

AdminUI Configuration Settings (API)

DbProvider Supported types and their values are:
- SqlServer
- MySql (Note: AdminUI requires the MySQL setting lower_case_table_names to be false)
- PostgreSql
IdentityConnectionString The connection string for the Identity database (Users, Claim Types, Roles etc.)
IdentityServerConnectionString The connection string for the IdentityServer database (Clients, Resources, Persited Grants etc.)
OperationalConnectionString (Optional) The connection string for the Presisted Grants DbContext. If not supplied, AdminUI will use the IdentityServerConnectionString
DataProtectionConnectionString (Optional) The connection string for the DataProtectionKey DbContext. If not supplied, AdminUI will use the IdentityServerConnectionString. Only needs configuring if you are using a database to store protection keys in the UI.
AuthorityUrl The IdentityServer installation protecting the API
UiUrl The AdminUI frontend
RequireHttpsMetadata When true ensures IdentityServer discovery endpoint uses TLS. Should be true for production
LicenseKey A valid license key for AdminUI
AdminUIClientSecret The AdminUI client shared secret value in plain text
TargetIdentityServer4 If set to true, AdminUI will target IdentityServer4 schema. If set to false, AdminUI will target Duende IdentityServer schema. Defaults to false.
PasswordPolicy:RequireDigit Defaults to true
PasswordPolicy:RequireLowercase Defaults to true
PasswordPolicy:RequireNonAlphanumeric Defaults to true
PasswordPolicy:RequireUppercase Defaults to true
PasswordPolicy:RequiredLength Defaults to 6
PasswordPolicy:RequiredUniqueChars Defaults to 1
UsernamePolicy:AllowedUserNameCharacters Defaults to abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+
UsernamePolicy:RequireUniqueEmail Defaults to true
AuditRecordsConnectionString The database connection string for AdminUI audits, if missing will default to the IdentityServerConnectionString
AuditRecordsCulture Language used for generation of audit records, if missing or invalid will default to English en-GB.

Supported languages are: - de German - zh-TW Chinese (Traditional) - zh-CN Chinese (Simplified) - es Spanish - fr French - AuditReadActions Defaults to true. If false, no audit records will be generated for read actions (e.g when a user views resources though AdminUI)
LoggingMinimumLevel Defaults to info. Supported logging levels are
- debug
- info
- warning
- error
- critical
LoggingOutputTemplate Defaults to [{Timestamp:dd-MM-yyyy HH:mm:ss} {Level}] {Message}{NewLine}{Exception}. For more infomation see the serilog docs.
AddUserPassword Defaults to false. If true, allows for setting a users password on creation (this is for demo purposes only, do not use in production), see more here
AzureAppServiceLogging (optional) Used for debugging the API - see the enable logging page for more details.

TargetIdentityServer4 Flag

The TargetIdentityServer4 flag in the API Configuration is used to determine what version of IdentityServer you want your AdminUI to target. If you're working with an IdentityServer4 database, you'll want to set this flag to true. If you're working with a Duende IdentityServer database, you'll want to set this flag to false.

This configuration setting will change how AdminUI displays certain entities such as Protected Resources, as well as if it will display certain views.

This setting will also change what migrations will be run by the migration tool.

Example Configurations

If you would like to see example web.config configurations you can find them here

UI appsettings.json:

{
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },

  "AllowedHosts": "*",
  "AuthorityUrl": "https://localhost:5003",
  "UiUrl": "http://localhost:5000",
  "ApiUrl": "http://localhost:5001",
  "AdminUIClientSecret": "Dev",

  "DataProtection": {
    "Persistence": {
      "Type": "Database",
      "DbProvider": "SqlServer",
      "DataProtectionConnectionString": "Server=localhost;User Id=AdminUI;Password=Password123!;Database=IdentityExpressDb;"
    },

    "Protection": {
      "Type": "Certificate",
      "CertificateType":  "Thumbprint", 
      "Thumbprint":  "c09fb8e928ef97fbd2a78be9bfe99341a2175af4" 
    }
  }
}

API appsettings.json:

{
  "LoggingMinimumLevel": "Info",

  "DbProvider": "SqlServer",
  "IdentityConnectionString": "Server=localhost;User Id=AdminUI;Password=Password123!;Database=IdentityExpressDb;",
  "IdentityServerConnectionString": "Server=localhost;User Id=AdminUI;Password=Password123!;Database=IdentityExpressDb;",
  "AuditRecordsConnectionString": "Server=localhost;User Id=AdminUI;Password=Password123!;Database=IdentityExpressDb;",

  "DataProtectionConnectionString": "Server=localhost;User Id=AdminUI;Password=Password123!;Database=IdentityExpressDb;",


  "AuthorityUrl": "https://localhost:5003",
  "UiUrl": "http://localhost:5000",
  "RequireHttpsMetadata": false,
  "LicenseKey": "",
  "CER_FULL_PATH": "./Data/gateway.cer",

  "RegistrationConfirmationEndpoint": "https://localhost:44379/api/confirmation",
  "ClientId": "PasswordReset",
  "ClientSecret": "password",
  "PasswordResetEndpoint": "https://localhost:44379/api/passwordreset",

  "PasswordPolicy": {
    "RequireDigit": true,
    "RequireLowercase": true,
    "RequireNonAlphanumeric": true,
    "RequireUppercase": true,
    "RequiredLength": 6,
    "RequiredUniqueChars": 1
  },
  "UsernamePolicy": {
    "UseReferenceTokens": false,
    "Secret": "password"
  },
  "AdminUIClientSecret": "Dev"
}

Previous Next