Global settings – the settings of the whole installation¶
The global settings hold everything that applies to the installation as a whole rather than to one application part: the license key, sign-in and password rules, the mail account nexxcite sends its own mails from, global styles and scripts, the file storage for images and more. This chapter lists every setting with its default and its meaning.
It is intended for administrators of a nexxcite installation. Settings that operators set in the configuration file of the application are described in Installation and configuration.
1. The global settings at a glance¶
You find the global settings in the Admin Studio under System → Settings. There is exactly one set of global settings per installation; it applies to all users and all servers.
The editor groups the settings into categories:
| Category | Content |
|---|---|
| Installation | Company name, stage, license key, conversation id prefix, reserved licenses, clock for system timestamps |
| Authoring | Whether definitions can be saved without a sketch |
| Login | Self-registration through external sign-in, password reset, password change |
| Login session | How long a sign-in stays valid |
| Login protection | Two-factor authentication, the temporary account lock and the authentication log |
| Password policy | Rules for passwords of the internal sign-in |
| Appearance | Global styles and scripts |
| Color tokens | Additional colors for all color pickers |
| Files | Storage for images and icon fonts |
| The mail account nexxcite sends its own mails from | |
| User profile | The form that shows a user their own profile |
| Background processing | How long the histories under Monitoring are kept |
| Developer console | What the developer console may see, and whether users notice it |
Like every editor, the editor has a header with "Display Name", "Description" and an icon. They only describe the settings in the Admin Studio and have no further effect.
Permissions¶
| Permission | Allows |
|---|---|
| "View Global Settings" | Opening System → Settings |
| "Edit Global Settings" | Saving changes |
Both are part of "System Administrator". By default, only system administrators have them.
2. Saving and when changes take effect¶
- The global settings can always be saved, even when "Allow changes without Sketch" is off.
- While a sketch is open, saving puts the change into the sketch, like any other change. It takes effect when the sketch is published. Without an open sketch, the change takes effect immediately. See Sketches and publishing.
- A changed license key is checked before it is saved. An invalid key is rejected with the message "The license key was not saved: …", and the previous key stays active. A valid key takes effect immediately – also while a sketch is open. See Licensing.
- Number fields accept whole numbers from 0 upwards. An empty or unreadable entry keeps the previous value – clearing a field cannot switch a rule off by accident.
- With several servers, the other servers pick up the change within seconds, at the latest after the definition cache expires (see Running several servers).
3. Installation¶
| Setting | Default | Meaning |
|---|---|---|
| "Company Name" | empty | Name of the installation. It is shown as the account name in authenticator apps and introduces the mails nexxcite sends (password reset). Empty uses "nexxcite". |
| "Stage" | empty | Free text for the stage of the installation, for example "Test" or "Production". It is stored, but currently has no effect. |
| "License Key" | empty | The license key of the installation. The tooltip summarises the stored key (licensee, term, concurrent licenses). See Licensing. |
| "Conversation Id Prefix" | NXC |
Prefix of the conversation id that outgoing messages carry, for example the "NXC" in [NXC-K7M2Q9XT4BVR]. Letters and digits only; empty or invalid entries use NXC. |
| "Reserved Licenses" | none | Users with a reserved license. They can always sign in, and each reserved license reduces the shared licenses permanently. See Licensing. |
| "Use UTC for system timestamps" | off | Which server clock fills the timestamps the system writes on its own – the "Created At" and "Last Modified At" fields. Off uses the local clock of the server, on uses UTC. |
The conversation id¶
nexxcite writes the conversation id into outgoing messages so that a reply can be assigned to the record it belongs to. A mailbox listener recognises the id in the reply. The prefix distinguishes the ids of your installation from those of another system that uses the same scheme – for example a test and a production installation that write to the same mailboxes.
Change the prefix with care. In our reading of the current behaviour, replies are recognised by the prefix that is configured at the time the reply arrives. Replies to messages that were sent with the previous prefix may then no longer be assigned automatically.
UTC or local time¶
Choose "Use UTC for system timestamps" when your users work in different time zones or when your servers run in a time zone other than your users. The setting affects only timestamps written from now on – existing values are not converted.
4. Authoring¶
| Setting | Default | Meaning |
|---|---|---|
| "Allow changes without Sketch" | off | On, definitions can be saved without an open sketch and take effect immediately for all users. Off, editors only save while a sketch is open. |
Some definitions can always be saved without a sketch: global settings, sketches, global values, users, roles, credentials and API access. See Sketches and publishing.
5. Sign-in: Login, Login session, Login protection, Password policy¶
These four categories decide how users sign in, how long a sign-in lasts and which passwords are accepted. Their effect on users is described in detail in Sign-in and sessions. The password policy and two-factor authentication apply to the internal sign-in of nexxcite; users who sign in through an external identity provider are not affected by them.
Login¶
| Setting | Default | Meaning |
|---|---|---|
| "Enable external login registration" | on | A person who signs in through an external identity provider for the first time and has no account yet can create one. Off, they are told that registration is not available. |
| "Enable reset password" | on | The sign-in page offers "Forgot password?", which mails a reset link. Needs the mail account under Mail – without it, the page tells the user that the reset is not configured. |
| "Enable change password" | on | A signed-in user can change their own password from the user menu. An administrator can set a password in the user editor either way, and an expired password is still asked for. |
When "Enable reset password" is on but no mail can be sent, nexxcite writes a warning to its log at every start.
Login session¶
| Setting | Default | Meaning |
|---|---|---|
| "Session lifetime (minutes)" | 480 | How long a sign-in stays valid. With the next setting switched on this is an idle timeout, otherwise a fixed term. 0 uses 480 minutes. |
| "Extend the session while it is used" | on | On, working with the application pushes the expiry out again. Off, the session ends a fixed time after the sign-in. |
| "Sign out at the latest after (hours)" | 0 | Upper limit for a session, however active the user is. Also limits a "Remember me" session. 0 switches the limit off. |
| "Offer "Remember me"" | on | The sign-in page offers to stay signed in after the browser was closed. Off, every session ends with the browser. |
| ""Remember me" lifetime (days)" | 14 | How long a remembered sign-in stays valid. 0 uses 14 days. |
| "Re-check the user every (minutes)" | 30 | How long it takes at most until a deactivation, a changed role or a new password reaches a session that is already signed in. 0 uses 30 minutes. |
Sign-ins survive a restart of nexxcite only when the key storage is configured
(DataProtection:KeyRingPath, see Installation and configuration).
Without it, every restart signs all users out, whatever is set here.
Login protection¶
| Setting | Default | Meaning |
|---|---|---|
| "Two-factor authentication" | "Disabled" | "Disabled" asks nobody for a second factor. "Optional" lets every user decide. "Enforced" sends every user who has not set it up yet to the setup of an authenticator app right after the sign-in. |
| "Lock account after failed attempts" | 5 | How many wrong passwords in a row lock an account temporarily. 0 switches the temporary lock off. |
| "Lock account for (minutes)" | 15 | How long the temporary lock lasts. It ends on its own; nobody has to unlock the account. |
| "Remember a device for (days)" | 14 | How long "Don't ask again on this device" skips the code of the second factor on that device. 0 removes the checkbox. |
| "Record sign in attempts" | Off | Records every attempt to sign in – user name, result, reason of a failure, IP address and browser – in the authentication log under Monitoring → Authentication Log. |
| "Keep sign in attempts for (days)" | 90 | How long an entry of the authentication log is kept. Older entries are deleted, also after the log was switched off. 0 keeps every entry. |
Before you choose "Enforced": every user of the internal sign-in then needs an authenticator app before they can work again. Inform your users beforehand.
The account lock protects a single account. A limit on sign-in attempts per caller, regardless of
the account, is set in the configuration file (LoginProtection, see
Installation and configuration).
Password policy¶
| Setting | Default | Meaning |
|---|---|---|
| "Password minimum length" | 6 | Minimum number of characters. |
| "Password different characters" | 1 | Number of different characters a password must contain. 1 means the rule is not applied. |
| "Password requires a digit" | on | At least one digit. |
| "Password requires a lower case letter" | on | At least one lower case letter. |
| "Password requires an upper case letter" | on | At least one upper case letter. |
| "Password requires a special character" | on | At least one character that is neither a letter nor a digit. |
| "Password expires after (days)" | 0 | How long a password stays valid after it was changed. Applies only to users whose password expires. 0 means such a password has to be changed once and then stays valid. |
The policy applies when a password is set or changed. Existing passwords that do not meet a stricter policy remain valid until they are changed.
6. Appearance¶
| Setting | Default | Meaning |
|---|---|---|
| "Global Styles" | none | Style sheet (CSS) for the whole application |
| "Form Styles" | none | Style sheet for forms |
| "Dashboard Styles" | none | Style sheet for dashboards |
| "Search Result Styles" | none | Style sheet for query results |
| "Global Scripts" | none | JavaScript that is loaded in the browser of every user |
Each of these settings refers to an expression whose result is the style sheet or script. Roles can add their own styles and scripts in addition.
Global scripts run in the browser of every user, administrators included. Treat changes to them like changes to the application code: only add scripts whose content and origin you know.
7. Custom color tokens¶
The section "Custom color tokens" adds colors to the built-in palette of nexxcite. Every color picker of the application offers them with their name, and a theme can recolor them per role. The values set here are the defaults.
| Field | Meaning |
|---|---|
| "Name" | What the color pickers call the token |
| "Description" | Shown as the tooltip of the entry in every color picker |
| "Light" | The color while the light color scheme is active |
| "Dark" | The color while the dark color scheme is active. Empty uses the light color in both schemes. |
Every token is also available as a CSS variable for your own style sheets; the editor shows its name on the card. Forms, grids and themes refer to a token by an internal id, so renaming a token changes nothing where it is used.
Removing a token asks for confirmation: everything that uses the color falls back to no color.
8. Files¶
| Setting | Default | Meaning |
|---|---|---|
| "Image File Provider" | none | Where images and icon fonts are stored: "Azure Blob Storage" or "S3 Storage" |
| "Image File Provider Credentials" | none | The credentials of that storage |
Without both settings, images and icon fonts cannot be uploaded. The editors then show "No file provider is configured. Please configure an Image File Provider and Credentials in the Global Settings." Files that you attach to AI assistants in their editor are stored there as well.
nexxcite does not store such files on the server itself. Credentials are created in the Admin Studio under Access → Credentials (see API access and credentials).
9. Mail¶
nexxcite sends some mails of its own – above all the password reset link. These mails are sent when nobody is signed in and no record is involved, so they need their own mail account.
| Setting | Default | Meaning |
|---|---|---|
| "Mail provider" | none | "SMTP" or "Exchange Online". Empty means nexxcite sends no mails of its own, which switches the password reset off. |
| "Mail account" | none | The credentials of the account. They have to match the provider: SMTP credentials for SMTP, Exchange Online credentials for Exchange Online. |
| "Sender address" | empty | Address the mails are sent from. Required for SMTP; for Exchange Online, the mailbox of the credentials is used when this stays empty. |
| "Sender name" | empty | Name shown next to the address, for example the name of your company. Optional. |
Mails that actions send use the credentials chosen in the action, not this account.
10. User profile¶
| Setting | Default | Meaning |
|---|---|---|
| "Profile form" | none | The form in which the address /identity/account/my shows the signed-in user their own record. Only forms of the entity marked as the user profile are offered. Empty uses the default form of that entity. |
nexxcite creates the user profile entity and a default form for it at the first start. The field is disabled if no entity is marked as the user profile.
11. Developer console¶
| Setting | Default | Meaning |
|---|---|---|
| "Send SQL statements to the developer console" | on | On, a developer console that observes a session also shows the database statements of that session, including their parameter values. Off, the database tab stays empty and the statements never leave the session. |
| "Show users that they are being observed" | on | On, a browser tab that a developer console observes shows a frame and a notice "Observed by …" with the name of the observer. Off, the observation is invisible to the user. |
Parameter values of database statements can contain anything users typed, including personal data. Switch the first setting off if that must not be visible to the people who use the developer console. A change applies to running observations within about 10 seconds. See Monitoring.
12. Background processing¶
| Setting | Default | Meaning |
|---|---|---|
| "Keep executions for (days)" | 30 | How long a run of the background processing – background actions, scheduled actions, mailbox listener polls – stays in the execution history under Monitoring → Background Processes. One row per run, so this decides the size of the history. At least 1 day. |
| "Keep execution logs for (days)" | 14 | How long the captured log of a run is kept. Logs are large, so they are usually kept shorter than the run. At least 1 day. |
| "Keep finished workflow processes for (days)" | 0 | How long a finished process of an event based workflow rule stays in Monitoring → Background Processes → Workflow Rules. 0 keeps every finished process. |
These values apply to the whole installation: every server cleans the same tables, so there is one retention, not one per server. A change is picked up by the next clean-up round, within a few minutes, without a restart. "Max Executions" of a rule is counted separately and is not affected by the retention. Whether the history is written at all, and what else happens on a server, is configured per server – see Installation and configuration.
13. Limitations¶
- "Stage" is stored but currently not evaluated anywhere.
- There is one set of global settings per installation. Different values per server or per role are not possible – except for styles, scripts and colors, which roles and themes can extend.
- Settings that operators make in the configuration file of the application (database, servers, timings) are not shown here. See Installation and configuration.
14. Frequently asked questions¶
Do I need a sketch to change the global settings? No. They can always be saved. If a sketch is open, however, the change goes into the sketch and takes effect only when it is published – except for the license key, which takes effect immediately.
I switched "Enable reset password" on, but users report that the reset is not configured. The mail account under Mail is missing or incomplete. nexxcite also writes a warning to its log at every start in this case.
Does a shorter "Session lifetime" apply to users who are already signed in? No. The lifetime is fixed when a user signs in, so the new value applies to sign-ins made after the change. To end existing sessions right away, end them in the Admin Studio (Authenticated Users or User Sessions). Details in Sign-in and sessions.
Does a stricter password policy force all users to change their password? No. It applies when a password is set or changed next time.
Can I upload images without cloud storage? No. Images and icon fonts are stored in Azure Blob Storage or an S3-compatible storage only.
Who can open the developer console? Users with the permission "Developer Console", which is part of "System Developer". The two settings in section 11 decide what they see and whether the observed user notices it.