RAEP - Advanced web.config configuration

The options below are advanced parameters stored in
C:\Program Files\VeridiumAD\RAEPServer\RaWebApp\web.config
Change them only under guidance from Veridium Support or when your deployment guide explicitly instructs you to do so.

Key	Default value	Description
AddAccountName	`false`	When set to `true`, RA looks up the user in the domain defined under UserDomain by UPN. Use this only when the Enrollment Agent cannot be used.
bopsVerifyJWTTokenForCitrix	`true`	For Citrix environments, every request is validated on the server. Leave at `true`; switch to `false` only if support explicitly advises it.
CheckPasswordExpiryByUPN	`false`	In Citrix deployments, RA finds the user with a UPN-based LDAP query (using ADShortDomain and AD\_LDAP\_Domain) and checks whether the password has expired.
CheckPasswordExpiryBySID	`false`	Same as above, but the lookup uses the user’s SID instead of UPN.
ADShortDomain	`dev.local`	Short domain name used for LDAP searches.
AD\_LDAP\_Domain	`LDAP://DC=dev,DC=local`	Full LDAP path used for directory searches.
AddUserSIDToCertRequest	`true`	Embeds the user’s SID in the certificate request (OID 1.3.6.1.4.1.311.25.2) to create a strong binding between user and certificate.
upnSuffixReplacement	(empty)	Lets you swap the UPN suffix in incoming requests—handy for Entra ID hybrid scenarios.
UseEmailAsUPN	`false`	When enabled, the email attribute from GetStaticProfile is used as the UPN; the original UPN is ignored.
cn	`{upn}`	Defines how the Common Name (CN) in the certificate is formatted. Choices: `{upn}`, `{email}`, `{samaccountname}`, `{displayname}`, `{firstname} {lastname}`, or `{lastname} {firstname}`.
UseUpnAsUserIdentifier	`false`	`false` = use SID as the user identifier; `true` = use UPN. Controls how GetStaticProfile locates the user.
AddUserNameHint	`false`	Adds a UserNameHint to the certificate based on the format defined in UserNameHintFormat. When `false`, the hint is left empty.
UserNameHintFormat	`{upn}`	Template for the UserNameHint; placeholders: `{upn}` or `{email}`.
AddEmailToCertRequest	`false`	Adds the user’s email address to the Subject Alternative Name (SAN) extension of the certificate.
AddUpnToCertRequest	`true`	Adds the user’s UPN to the Subject Alternative Name (SAN) extension of the certificate.