RAEP - Advanced web.config configuration

AddAccountName

false

When set to true, RA looks up the user in the domain defined under UserDomain by UPN. Use this only when the Enrollment Agent cannot be used.

bopsVerifyJWTTokenForCitrix

true

For Citrix environments, every request is validated on the server. Leave at true; switch to false only if support explicitly advises it.

CheckPasswordExpiryByUPN

false

In Citrix deployments, RA finds the user with a UPN-based LDAP query (using ADShortDomain and AD\_LDAP\_Domain) and checks whether the password has expired.

CheckPasswordExpiryBySID

false

Same as above, but the lookup uses the user’s SID instead of UPN.

ADShortDomain

dev.local

Short domain name used for LDAP searches.

AD\_LDAP\_Domain

LDAP://DC=dev,DC=local

Full LDAP path used for directory searches.

AddUserSIDToCertRequest

true

Embeds the user’s SID in the certificate request (OID 1.3.6.1.4.1.311.25.2) to create a strong binding between user and certificate.

upnSuffixReplacement

(empty)

Lets you swap the UPN suffix in incoming requests—handy for Entra ID hybrid scenarios.

UseEmailAsUPN

false

When enabled, the email attribute from GetStaticProfile is used as the UPN; the original UPN is ignored.

cn

{upn}

Defines how the Common Name (CN) in the certificate is formatted. Choices: {upn}, {email}, {samaccountname}, {displayname}, {firstname} {lastname}, or {lastname} {firstname}.

UseUpnAsUserIdentifier

false

false = use SID as the user identifier; true = use UPN. Controls how GetStaticProfile locates the user.

AddUserNameHint

false

Adds a UserNameHint to the certificate based on the format defined in UserNameHintFormat. When false, the hint is left empty.

UserNameHintFormat

{upn}

Template for the UserNameHint; placeholders: {upn} or {email}.

AddEmailToCertRequest

false

Adds the user’s email address to the Subject Alternative Name (SAN) extension of the certificate.

AddUpnToCertRequest

true

Adds the user’s UPN to the Subject Alternative Name (SAN) extension of the certificate.