> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NetServer Security element

> NetServer configuration sections related to domain- and operational security settings.

The security section group contains three configuration sections related to domain- and operational security settings.

<Danger>
  Do not change these values unless you are absolutely sure!
</Danger>

```XML theme={null}
<Security>
  <ActiveDirectoryCredentialPlugin>
    <add key="Domain" value="" />
    <add key="Container" value="OU=,DC=,DC=" />
    <add key="User" value="" />
    <add key="Password" value="" />
  </ActiveDirectoryCredentialPlugin>
  <Cryptography>
    <add key="SymmetricKey" value="" />
    <add key="SymmetricIV" value="" />
    <add key="SymmetricSecret" value="" />
  </Cryptography>
  <Sentry>
    <add key="Ignore" value="false" />
  </Sentry>
  <SoPasswordCredentialPlugin>
    <add key="DisableUseExternalAssociate" value="false" />
    <add key="DisableUseInternalAssociate" value="false" />
    <add key="DisableUseSystemAssociate" value="false" />
  </SoPasswordCredentialPlugin>
</Security>
```

## ActiveDirectoryCredentialPlugin

Configuration settings related to Active Directory domain.

| Name                      | Description                                                                                                                                                                                                                                                                                                                                                                                                                                             | Default |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| Container                 | The container on the store to use as the root of the context. Default container is used when nothing is provided. Leave it blank if you do not know. All queries are performed under this root.                                                                                                                                                                                                                                                         |         |
| DisableIntegration        | Disable integration with Active Directory.                                                                                                                                                                                                                                                                                                                                                                                                              | false   |
| Domain                    | Name of the domain for authentication. Default domain is used when nothing is provided. The name of the domain or server for `System.DirectoryServices.AccountManagement.ContextType.Domain` context types, the machine name for `System.DirectoryServices.AccountManagement.ContextType.Machine` context types, or the name of the server and port hosting the `System.DirectoryServices.AccountManagement.ContextType.ApplicationDirectory` instance. |         |
| Password                  | The user password used to connect to the store.                                                                                                                                                                                                                                                                                                                                                                                                         |         |
| PriorityInternalAssociate | Priority of the plugin for internal associates.                                                                                                                                                                                                                                                                                                                                                                                                         |         |
| User                      | The username used to connect to the store. It must be able to list and view users. If the username and password parameters are not configured, the default credentials of the current principal are used. Otherwise, both username and password must be configured, and the credentials they specify are used to connect to the store.                                                                                                                  |         |

<Warning>
  To find and import Active Directory users, NetServer web services need to be in the Active Directory domain. This is why we recommend [onsite deployment scenario 2][3] with a reverse proxy so you do not expose it to the DMZ.
</Warning>

## Cryptography

Cryptography is used for encrypting and decrypting the user credentials and sessions.

<Warning>
  Change any of these keys at your own peril.
</Warning>

| Name            | Description                             |
| --------------- | --------------------------------------- |
| SymmetricIV     | The IV used in the Rijndael algorithm.  |
| SymmetricKey    | The Key used in the Rijndael algorithm. |
| SymmetricSecret | A secret phrase used as a signature.    |

The `SymmetricKey` and the `SymmetricIV` are used in the Rijndael-based (`System.Security.Cryptography.Rijndael`) encryption and decryption methods. The `SymmetricSecret` is used to compute a hash code using the SHA256Managed classes (`System.Security.Cryptography.SHA256Managed`). The key-value pairs in the section are used in NetServer session suspend and session continue routines.

When a [session is suspended][4], the `SymmetricKey` and the `SymmetricIV` are used to encrypt the session information, where the `SymmetricSecret` creates a hash code. Using a `CryptoStream` (`System.Security.Cryptography.CryptoStream`), the encrypted session data and the computed hash will be written to a `MemoryStream` (`System.IO.MemoryStream`) and returned as a Base64String for subsequent calls to a session's `Continue` method.

In `SoSession.Continue`, the `SymmetricKey` and the `SymmetricIV` will be used to decrypt the session data, and the `SymmetricKey` will be used to compute the hash code. The hash code generated by `session.Suspend` method is checked against the hash code generated by the continue method to verify whether the encrypted and decrypted information are the same and have not been tampered.

The `SymmetricKey` and the `SymmetricIV` are generated values while the `SymmetricSecret` is a user-defined secret.

It is important to know that if your system is using a server cluster these values should be identical in all cluster machines.

## Sentry

Sentry configuration options.

| Name   | Description                                                   | Default |
| ------ | ------------------------------------------------------------- | ------- |
| Ignore | Ignore the [Sentry mechanism][2], everything will be allowed. | false   |

## SoPasswordCredentialPlugin

SuperOffice password credentials plugin options.

| Name                        | Description                                                            | Default |
| --------------------------- | ---------------------------------------------------------------------- | ------- |
| DisableUseExternalAssociate | Disables SuperOffice password for External associates.                 | false   |
| DisableUseInternalAssociate | Disables SuperOffice-passwords for Internal associates (normal users). | false   |
| DisableUseSystemAssociate   | Disables SuperOffice password for System associates.                   | false   |
| PriorityInternalAssociate   | Priority of the plugin for internal associates.                        |         |

See the [NetServer Core reference][1] for details about handling this programmatically.

[1]: https://github.com/SuperOfficeDocs/superoffice-docs/blob/main/docs/en/api/reference/netserver/core/SuperOffice.Configuration.ConfigFile.Security.yml

[2]: ../security/sentry/index

[3]: ../../onsite/security/deployment-scenarios#scenario2

[4]: https://github.com/SuperOfficeDocs/superoffice-docs/blob/main/docs/en/api/authentication/onsite/sosession/index.mdx


## Related topics

- [NetServer WebApi element](/en/onsite/web-config/webapi.md)
- [NetServer Reporter element](/en/onsite/web-config/reporter.md)
- [NetServer Services element](/en/onsite/web-config/services.md)
- [NetServer Scripting element](/en/onsite/web-config/scripting.md)
- [NetServer Infrastructure element](/en/onsite/web-config/infrastructure.md)
- [NetServer Webhooks element](/en/onsite/web-config/webhooks.md)