Some servers may require an Account for logon or in order to access specific privileges, like uploading or deleting files.

This setting controls the selection logic of the data connection. By default this value is True and the connector will attempt to determine the best IP for the data connection based on the returned value from the server. It is recommended to leave this value set to True unless there is a reason to disable it.

In many cases FTP servers are not configured to return a valid public IP in the PASV response. When SSL/TLS is used any NAT done by the firewall cannot occur and the result is the client may receive an IP that is not accessible.

This setting is designed to allow the connection to succeed in as many cases as possible. When the IP for the data connection is received from the server the connector will inspect the value. If the received value is not within the known private IP ranges the connector will use it, assuming it is a valid public IP. If the received value is a private IP the connector will instead assume the data connection should be established to the same IP as the command connection (true in almost all cases).

When this setting if False, the connector will not perform any checks on the received value. When set to False UseRemoteHostAddressForPassive is applicable.

If set to "FALSE" the adapter will not perform a directory listing to check for the presence of the file on the server before uploading the file.

NOTE: This setting is only applicable to the FTP Transmitter.

This may be set to the location of a file on disk that will hold the names of files that were previously downloaded from the server. On each PollingInterval the connector will check to see if the file on the server exists in this list. If the file exists in this list, it is determined that the file was previously downloaded and is not downloaded on the current polling interval. The list is automatically updated on each polling interval.

If a file name is added to the DownloadCacheFile and is not seen on the server again within DownloadCacheFileDuration minutes, it will be removed from the cache. This can prevent the download cache file from growing too large in certain cases.

The default value is 0, meaning that files will never be removed.

This setting is only applicable if DownloadCacheFile is set.

This setting is used in conjunction with DownloadCacheFile, and is only available on the receive connector. If DownloadCacheFile is enabled, this setting can be used to control how the receive connector uses the download file cache information when deciding whether to download a file again. (Similar to the "Enable Timestamp Comparison" property on Microsoft's FTP BizTalk Adapter.)

If this is set to False, the receive connector will not download a file again if the cache contains any information about it (that is, if it has been downloaded before).

If this is set to True, the receive connector will check the metadata of the remote file against its cached metadata, and will download the file again if any of the metadata differs.

This configuration setting is used to specify a mask to exclude certain files when downloading. If a file matches both this mask and FileMask, the file will be not be downloaded.

By default, the connector will download all available files (matching any filemasks) when polling the target directory. To limit the number of files that will be downloaded in a single poll, set this to the maximum number.

Note that to avoid downloading the same subset of files each poll, either DownloadCacheFile or DeleteMode should also be used.

The default value is 7. Valid values are from 0 to 9. A higher value indicates a higher compression level is used. This is only valid when UseModeZ is set to True.

When set to use active mode (Passive = False), the connector uses any available port to listen to incoming connections from the server. You can override this behavior by setting PortRange to a value containing the range of ports the connector will be listening to.

The range is provided as start-end, for instance: "1024-" stands for anything higher than 1024, "1024-2048" stands for ports between 1024 and 2048 inclusive, "4000-4010, 50000-50010" stands for ports between 4000 and 40010 or between 50000 and 50010.

When set to True, the connector will reuse the PI SSL session when creating the DI connection. The default value for this configuration setting is False, in which case, the connector will create a separate SSL session for the DI connection.

When set to True (default), the connector will ask the server to reuse the existing DI SSL session. When set to False, a new SSL session will always be created for the DI connection.

When set, the connector will send the CCC command to the server requesting a clear (unprotected) command channel.

When this is set, the connector will use a clear (unprotected) data channel by sending the PROT C command to the server.

When set, extended passive mode will be used.

This is only applicable when UseSimpleDirList is set to true. When UseSimpleDirList is true, the connector issues the command "NLST -F <filemask>". The -F parameter tells the server to omit folder names from the response. Some server do not support the -F parameter. To disable the use of the -F parameter set UseFSwitch to False. The default value is True.

When this is set to True the connector will list files in the directory using the MLSD command. This command is an extension to the protocol which defines a more standardized and reliable directory listing format. Not all servers support this command. The default value is False.

The default value is false. When set to true the connector will issue the "MODE Z" command to the FTP server. This will enable deflate compression so all data transferred is first compressed either by the server (when downloading) or by the connector (when uploading). Note that not all servers support this feature.

The connector will send the PROT P command to the server explicitly indicating that the data channel will be protected when this is set. This only applies when the SSLStartMode is set to sslImplicit.

This setting is only used when Passive is true. When this is set to false (default), the connector parses the remote host to send replies to from the previous response from the server. If this is true, the connector uses the value at FTPServer instead.

If set to true, the connector will reuse the context if and only if the following criteria are met:

• The target host name is the same.
• The system cache entry has not expired (default timeout is 10 hours).
• The application process that calls the function is the same.
• The logon session is the same.
• The instance of the connector is the same.

This minimum cipher strength largely dependent on the security modules installed on the system. If the cipher strength specified is not supported, an error will be returned when connections are initiated.

Please note that this setting contains the minimum cipher strength requested from the security library.

Use this setting with caution. Requesting a lower cipher strength than necessary could potentially cause serious security vulnerabilities in your application.

The enabled cipher suites to be used in SSL negotiation.

By default, the enabled cipher suites will include all available ciphers ("*").

The special value "*" means that the connector will pick all of the supported cipher suites. If SSLEnabledCipherSuites is set to any other value, only the specified cipher suites will be considered.

Multiple cipher suites are separated by semicolons.

Example values when UseInternalSecurityAPI is False (default):

// The "Other" property could contain ONE of the following lines:
SSLEnabledCipherSuites=*
SSLEnabledCipherSuites=CALG_AES_256
SSLEnabledCipherSuites=CALG_AES_256;CALG_3DES

• CALG_3DES
• CALG_3DES_112
• CALG_AES
• CALG_AES_128
• CALG_AES_192
• CALG_AES_256
• CALG_AGREEDKEY_ANY
• CALG_CYLINK_MEK
• CALG_DES
• CALG_DESX
• CALG_DH_EPHEM
• CALG_DH_SF
• CALG_DSS_SIGN
• CALG_ECDH
• CALG_ECDH_EPHEM
• CALG_ECDSA
• CALG_ECMQV
• CALG_HASH_REPLACE_OWF
• CALG_HUGHES_MD5
• CALG_HMAC
• CALG_KEA_KEYX
• CALG_MAC
• CALG_MD2
• CALG_MD4
• CALG_MD5
• CALG_NO_SIGN
• CALG_OID_INFO_CNG_ONLY
• CALG_OID_INFO_PARAMETERS
• CALG_PCT1_MASTER
• CALG_RC2
• CALG_RC4
• CALG_RC5
• CALG_RSA_KEYX
• CALG_RSA_SIGN
• CALG_SCHANNEL_ENC_KEY
• CALG_SCHANNEL_MAC_KEY
• CALG_SCHANNEL_MASTER_HASH
• CALG_SEAL
• CALG_SHA
• CALG_SHA1
• CALG_SHA_256
• CALG_SHA_384
• CALG_SHA_512
• CALG_SKIPJACK
• CALG_SSL2_MASTER
• CALG_SSL3_MASTER
• CALG_SSL3_SHAMD5
• CALG_TEK
• CALG_TLS1_MASTER
• CALG_TLS1PRF

// The "Other" property could contain ONE of the following lines:
SSLEnabledCipherSuites=*
SSLEnabledCipherSuites=TLS_DHE_DSS_WITH_AES_128_CBC_SHA
SSLEnabledCipherSuites=TLS_DHE_DSS_WITH_AES_128_CBC_SHA;TLS_DH_ANON_WITH_AES_128_CBC_SHA

• TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
• TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
• TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
• TLS_DHE_DSS_WITH_AES_128_CBC_SHA
• TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
• TLS_DHE_DSS_WITH_AES_256_CBC_SHA
• TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
• TLS_DHE_DSS_WITH_DES_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
• TLS_DHE_RSA_WITH_DES_CBC_SHA
• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_128_GCM_SHA256
• TLS_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_RSA_WITH_DES_CBC_SHA
• TLS_RSA_WITH_RC4_128_MD5
• TLS_RSA_WITH_RC4_128_SHA

If SSLEnabledProtocols is configured to use TLS 1.3 the following values are supported:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384

SSLEnabledCipherSuites is used together with SSLCipherStrength.

Used to enable/disable the supported security protocols.

Not all supported protocols are enabled by default (the value of this setting is 4032). If you want more granular control over the enabled protocols, you can set this property to the binary 'OR' of one or more of the following values:

Note: TLS 1.1 and TLS1.2 support are only available starting with Windows 7.

Note: Enabling TLS 1.3 will automatically set UseInternalSecurityAPI to True.

This setting specifies whether the transport log contains the full certificate chain. By default this value is False and only the leaf certificate will be present.

If set to True all certificates returned by the server will be present in the transport log. This includes the leaf certificate, any intermediate certificate, and the root certificate.

Note: When UseInternalSecurityAPI is set to True this value is automatically set to True. This is needed for proper validation when using the internal provider.

The following flags are defined (specified in hexadecimal notation). They can be or-ed together to exclude multiple conditions:

This setting specifies the allowed server certificate signature algorithms when UseInternalSecurityAPI is True and SSLEnabledProtocols is set to allow TLS 1.2.

When specified the connector will verify that the server certificate signature algorithm is among the values specified in this setting. If the server certificate signature algorithm is unsupported the connector will fail with an error.

The format of this value is a comma separated list of hash-signature combinations. For instance:

// The "Other" could contain ALL of these lines:
UseInternalSecurityAPI=true
SSLEnabledProtocols=3072
TLS12SignatureAlgorithms=sha1-rsa,sha1-dsa,sha256-rsa,sha256-dsa

In order to not restrict the server's certificate signature algorithm, specify an empty string as the value for this setting, which will cause the signature_algorithms TLS 1.2 extension to not be sent.

This setting specifies a comma separated list of named groups used in TLS 1.2 for ECC.

The default value is ecdhe_secp256r1,ecdhe_secp384r1,ecdhe_secp521r1.

When using TLS 1.2 and UseInternalSecurityAPI is set to True, the values refer to the supported groups for ECC. The following values are supported:

• "ecdhe_secp256r1" (default)
• "ecdhe_secp384r1" (default)
• "ecdhe_secp521r1" (default)

This setting specifies a comma separated list of named groups used in TLS 1.3 for key exchange. The groups specified here will have key share data pregenerated locally before establishing a connection. This can prevent an additional round trip during the handshake if the group is supported by the server.

The default value is set to balance common supported groups and the computational resources required to generate key shares. As a result only some groups are included by default in this setting.

Note: All supported groups can always be used during the handshake even if not listed here, but if a group is used which is not present in this list it will incur an additional round trip and time to generate the key share for that group.

In most cases this setting does not need to be modified. This should only be modified if there is a specific reason to do so.

The default value is ecdhe_x25519,ecdhe_secp256r1,ecdhe_secp384r1,ffdhe_2048,ffdhe_3072

The values are ordered from most preferred to least preferred. The following values are supported:

• "ecdhe_x25519" (default)
• "ecdhe_x448"
• "ecdhe_secp256r1" (default)
• "ecdhe_secp384r1" (default)
• "ecdhe_secp521r1"
• "ffdhe_2048" (default)
• "ffdhe_3072" (default)
• "ffdhe_4096"
• "ffdhe_6144"
• "ffdhe_8192"

This setting holds a comma separated list of allowed signature algorithms. Possible values are:

• "rsa_pkcs1_sha256" (default)
• "rsa_pkcs1_sha384" (default)
• "rsa_pkcs1_sha512" (default)

This setting specifies a comma separated list of named groups used in TLS 1.3 for key exchange. This setting should only be modified if there is a specific reason to do so.

The default value is ecdhe_x25519,ecdhe_x448,ecdhe_secp256r1,ecdhe_secp384r1,ecdhe_secp521r1,ffdhe_2048,ffdhe_3072,ffdhe_4096,ffdhe_6144,ffdhe_8192

The values are ordered from most preferred to least preferred. The following values are supported:

• "ecdhe_x25519" (default)
• "ecdhe_x448" (default)
• "ecdhe_secp256r1" (default)
• "ecdhe_secp384r1" (default)
• "ecdhe_secp521r1" (default)
• "ffdhe_2048" (default)
• "ffdhe_3072" (default)
• "ffdhe_4096" (default)
• "ffdhe_6144" (default)
• "ffdhe_8192" (default)

If AbsoluteTimeout is set to True, any method which does not complete within Timeout seconds will be aborted. By default, AbsoluteTimeout is False, and the timeout is an inactivity timeout.

The LocalHost configuration contains the name of the local host as obtained by the Gethostname() system call, or if the user has assigned an IP address, the value of that address.

In multihomed hosts (machines with more than one IP interface) setting LocalHost to the value of an interface will make the connector initiate connections (or accept in the case of server connectors) only through that interface.

If the connector is connected, the LocalHost configuration shows the IP address of the interface through which the connection is made in internet dotted format (aaa.bbb.ccc.ddd). In most cases, this is the address of the local host, except for multihomed hosts (machines with more than one IP interface).

When true, the socket will send all data that is ready to send at once. When false, the socket will send smaller buffered packets of data at small intervals. This is known as the Nagle algorithm.

By default, this config is set to false.

By default the connector will use the system security libraries to perform cryptographic functions. Setting this to True tells the connector to use the internal implementation instead of using the system's security API.