---
title: Scripting environment
description: AM supports scripts written in either JavaScript, or Groovy. Scripts used for client-side authentication must be written in JavaScript.
component: pingam
version: 7.2
page_id: pingam:scripting-guide:scripting-env
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-scripting/scripting-env.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-scripting/scripting-env.html
---

# Scripting environment

AM supports scripts written in either JavaScript, or Groovy. Scripts used for client-side authentication must be written in JavaScript.

> **Collapse: How to determine the JavaScript Engine Version**
>
> You can use a script to check the version of the JavaScript engine AM is using. You could temporarily add the following script to a Scripted Decision node, for example, to output the engine version to the debug log:
>
> ```javascript
> var rhino = JavaImporter(
>   org.mozilla.javascript.Context
> )
>
> var currentContext = rhino.Context.getCurrentContext()
> var rhinoVersion = currentContext.getImplementationVersion()
>
> logger.error("JS Script Engine: " + rhinoVersion)
>
> outcome = "true"
> ```
>
> |   |                                                                                                                                                                                                                                                                                                                                                                                       |
> | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
> |   | Ensure the following are listed in the Java class whitelist property of the scripting engine.- `org.mozilla.javascript.Context`
>
> - `org.forgerock.openam.scripting.timeouts.*`To view the Java class allowlist, go to Configure > Global Services > Scripting > Secondary Configurations. Select the script type, and on the Secondary Configurations tab, click engineConfiguration. |
>
> AM uses the Mozilla Rhino JavaScript engine.

> **Collapse: How to determine the Groovy engine version**
>
> You can use a script to check the version of the Groovy scripting engine AM is using. You could temporarily add the following script to a Scripted Decision node, for example, to output the engine version to the debug log:
>
> ```groovy
> logger.error("Groovy Script Engine: " + GroovySystem.version)
>
> outcome = "true"
> ```
>
> |   |                                                                                                                                                                                                                                                                                                                                  |
> | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
> |   | Ensure the following are listed in the Java class whitelist property of the scripting engine.- `groovy.lang.GroovySystem`To view the Java class allowlist, go to Configure > Global Services > Scripting > Secondary Configurations. Select the script type, and on the Secondary Configurations tab, click engineConfiguration. |
>
> AM uses the [Apache Groovy](https://groovy-lang.org/index.html) engine.

To access the functionality AM provides, import the required Java class or package, as follows:

* JavaScript

* Groovy

```javascript
var fr = JavaImporter(
    org.forgerock.openam.auth.node.api,
    javax.security.auth.callback.NameCallback
);
with (fr) {
    ...
}
```

```groovy
import org.forgerock.openam.auth.node.api.*;
import javax.security.auth.callback.NameCallback;
```

You may need to allowlist the classes you use in scripts. See [Security](script-engine-security.html).

You can use scripts to modify default AM behavior in the following situations, also known as *contexts*:

* Client-side authentication

  Scripts that are executed on the client during authentication.

Client-side scripts must be in JavaScript.

* Server-side authentication

  Scripts are included in an authentication module within a chain and are executed on the server during authentication.

* Authentication trees

  Scripts are included in an authentication node within a tree and are executed on the server during authentication.

* Policy conditions

  Scripts used as conditions within policies.

* OIDC claims

  Scripts that gather and populate the claims in a request when issuing an ID token or making a request to the `userinfo` endpoint.

* OAuth 2.0 access tokens

  Scripts that modify the key-value pairs contained within access tokens before they are issued to a client.

AM implements a configurable scripting engine for each of the context types that are executed on the server.

The scripting engines in AM have two main components: security settings, and the thread pool.

![The scripting engines contain configuration for security settings and thread pool management.](_images/scripting-engine-overview.png)