Authentication module properties

Specifies the base DN from which AM searches for users to authenticate.

Specify the user and password of the administration account used for authentication to the directory server.

LDAP uses this attribute to search for the profile of an authenticated user. Usually, this is the same attribute used to find the user account, such as the value set as the uid in AM. For example, where the attribute is set to mail, the LDAP module searches CN=Users,DC=example,DC=com with a filter "(MAIL=bjensen@example.com)", and the directory returns the user profile that matches MAIL=bjensen@example.com.

The attributes specified in this list define the LDAP search filter. Multiple attribute values mean the user can authenticate with any one of the values. For example, if you have both uid and mail, then Barbara Jensen can authenticate with either bjensen or bjensen@example.com.

The User Search Filter text box provides a more complex filter. For example, if you search using mail and add the User Search Filter (objectClass=inetOrgPerson), then AM uses the resulting search filter (&(mail=address)(objectClass=inetOrgPerson)), where address is the mail address provided by the user.

This attribute defines the level of directory that will be searched for a matching profile. You can set the search to run at a high level or against a specific area:

If you want to initiate secure communications to data stores using SSL or StartTLS, AM must be able to trust the server’s certificates, either because the certificates were signed by a CA whose certificate is already included in the trust store used by the container where AM runs, or because you imported the certificates into the trust store.

If User Profile is set to Required, this attribute determines whether the DN or the username is returned as the authentication principal.

This list of attributes defines the mapping of internal attribute names to external attribute names for dynamic profile creation. The attributes retrieved from the user’s authenticated profile are mapped against the values that will be provisioned into their matching account in the data store. This list does not include uid mappings.

When enabled, the module trusts all server certificates, including self-signed certificates.

Specifies how often AM should send a heartbeat request to the directory server to ensure that the connection does not remain idle. Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. You can turn this off by setting the value to 0. To set the units for the interval, use LDAP Connection Heartbeat Time Unit.

Specifies the time unit corresponding to LDAP Connection Heartbeat Interval. Possible values are SECONDS, MINUTES, and HOURS.

Defines the timeout, in seconds, that AM should wait for a response from the directory server.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

If enabled, prevent AM from sending further bind requests to the LDAP Server when the user is locked out through a duration lockout.

Specifies the location of the authorized_keys file that contains the private and public keys used to validate remote amster client connections.

When enabled, allows amster clients to authenticate using PKI. When disabled, allows amster clients to authenticate using interactive login only.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Specifies the list of valid anonymous user IDs that can log in without submitting a password.

protocol://hostname:port/deploy_URI/XUI/?module=Anonymous&org=org_name#login

Specifies the user ID assigned by the module if the Valid Anonymous Users list is empty. The default value is anonymous. Note that the anonymous user must be defined in the realm, and its user status must be Active.

When enabled, determines whether case matters for anonymous user IDs.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 (default) to any positive integer and is set for each authentication method. The higher number corresponds to a higher level of authentication. If you configured your authentication levels from a 0 to 5 scale, then an authentication level of 5 will require the highest level of authentication.

When enabled, AM searches for a match for the user’s certificate in the LDAP directory. If a match is found and not revoked according to a CRL or OCSP validation, then authentication succeeds.

Indicates which attribute and value in the certificate Subject DN is used to find the LDAP entry holding the certificate.

When enabled, AM checks whether the certificate has been revoked according to a CRL in the LDAP directory.

Indicates which attribute and value in the certificate Issuer DN is used to find the CRL in the LDAP directory.

Specifies parameters to be included in any HTTP CRL call to the CA that issued the certificate.

When enabled, AM checks the CRL against the CA certificate to ensure it has not been compromised.

(LDAP distribution points only) When enabled, AM caches CRLs.

When enabled, AM updates the CRLs stored in the LDAP directory store.

When enabled, AM checks the revocation status of certificates using the Online Certificate Status Protocol (OCSP).

Identifies the LDAP server that holds users; certificates. The property has the format ldap-server:port, for example, ldap1.example.com:636. To configure a secure connection, enable the Use SSL/TLS for LDAP Access property.

Valid base DN for the LDAP search, such as dc=example,dc=com. To associate AM servers with§ different search base DNs, use the format openam_server|base_dn, for example, openam.example.com|dc=example,dc=com openam1.test.com|dc=test,dc=com.`

If AM stores attributes in the LDAP directory, for example to manage account lockout, or if the LDAP directory requires that AM authenticate in order to read users' attributes, then AM needs the DN and password to authenticate to the LDAP directory.

If you use SSL/TLS for LDAP access, AM must be able to trust the LDAP server certificate.

If the user profile is in a different entry from the user certificate, then this can be different from subject DN attribute used to find the entry with the certificate. When you select other, provide an attribute name in the Other Certificate Field Used to Access User Profile text box.

This field is only used if the Certificate Field Used to Access User Profile attribute is set to other. This field allows a custom certificate field to be used as the basis of the user search.

Specifies how to look up the user profile:

Defines a list of hosts trusted to send certificates to AM, such as load balancers doing SSL termination.

Specifies the name of the HTTP request header containing the certificate, which can be in one of the following formats:

When enabled, AM always uses the client certificate from the HTTP header rather than the certificate the servlet container receives during the SSL handshake.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Enable Device ID (Match) to send JavaScript in an authentication page to the device to collect data about the device by a self-submitting form.

Specify the client-side and server-side Javascript scripts to use with the Device Id (Match) module.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

When enabled, AM assumes user consent to store new profiles. After successful HOTP confirmation, AM stores the new profile automatically.

Sets the maximum number of stored profiles on the user’s record.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the length of the OTP to six digits or longer. The default value is six.

The minimum number of hexadecimal characters allowed for the secret key.

Select whether to use HOTP or TOTP. You can create an authentication chain to allow for a greater variety of devices. The default value is HOTP.

The window that the OTP device and the server counter can be out of sync. For example, if the window size is 100 and the server’s last successful login was at counter value 2, then the server will accept an OTP from device counter 3 to 102. The default value is 100.

Adds a checksum digit at the end of the HOTP password to verify the OTP was generated correctly. This is in addition to the actual password length. Set this only if your device supports it. The default value is No.

Advanced feature that is device-specific. Let this value default unless you know your device uses a truncation offset. The default value is -1.

The time interval for which an OTP is valid. For example, if the time step interval is 30 seconds, a new OTP will be generated every 30 seconds, and an OTP will be valid for 30 seconds. The default value is 30 seconds.

The number of time step intervals that the system and the device can be off before password resynchronization is required. For example, if the number of TOTP time steps is 2 and the TOTP time step interval is 30 seconds, the server will allow an 89 second clock skew between the client and the server—two 30 second steps plus 29 seconds for the interval in which the OTP arrived. The default value is 2.

The number of times entry of the OTP may be attempted. Minimum is 1, maximum is 10.

The maximum acceptable clock skew before authentication fails. When this value is exceeded, the user must re-register the device.

A value that appears as an identifier on the user’s device. Common choices are a company name, a web site, or an AM realm.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

The period of time (in milliseconds) within which a push notification should be replied to.

Text content of the push message, which is used for the notification displayed on the registered device. The following variables can be used in the message:

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

A value that appears as an identifier on the user’s device. Common choices are a company name, a web site, or an AM realm.

The period of time (in milliseconds) to wait for a response to the registration QR code. If no response is received during this time the QR code times out and the registration process fails.

The background color in hex notation to display behind the issuer’s logo within the ForgeRock Authenticator app.

The location of an image to download and display as the issuer’s logo within the ForgeRock Authenticator app.

URL of the app to download on the App Store.

URL of the app to download on Google Play.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Specifies the class the HOTP module uses to send SMS or email messages. Specify a class that implements the com.sun.identity.authentication.modules.hotp.SMSGateway interface to customize the SMS gateway implementation.

Specifies the hostname of the mail server supporting SMTP for electronic mail.

Specifies the outgoing mail server port. The default port is 25, 465 (when connecting over SSL), or 587 (for StartTLS).

Specifies the username for AM to connect to the mail server.

Specifies the password for AM to connect to the mail server.

Specifies whether to connect to the mail server securely. If enabled, AM must be able to trust the server certificate.

Specifies the From: address when sending a one-time password by mail.

Specifies the amount of time, in minutes, the one-time passwords are valid after they are generated. The default is 5 minutes.

Sets the length of one-time passwords.

The number of times entry of the OTP may be attempted. Minimum is 1, maximum is 10.

Specifies whether to send the one-time password by SMS, by mail, or both.

Provides the attribute name used for the text message. The default value is telephoneNumber.

Specifies a user profile attribute that contains a mobile carrier domain for sending SMS messages.

Provides the attribute name used to email the OTP. The default value is mail (email).

When enabled, configures the HOTP module to automatically generate an email or text message when users begin the login process.

Specifies the module that checks the user credentials. The credentials are then supplied to either a data store or other identity repository module for authentication.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Determines how the module obtains the connection to the database.

Specifies the URL of the connection pool for JNDI connections. Refer to your web container’s documentation for instructions on setting up the connection pool.

Specifies the JDBC driver to use for JDBC connections.

Specifies the URL to connect to the database when using a JDBC connection.

Specifies the user name and password used to authenticate to the database when using a JDBC connection.

Specifies the database column name where passwords are stored.

Specifies the SQL query to return the password corresponding to the user to authenticate.

Specifies the class that transforms the password retrieved to the same format as provided by the user.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Specifies the base DN from which AM searches for users to authenticate.

Specify the user and password of the administration account used for authentication to the directory server.

LDAP uses this attribute to search for the profile of an authenticated user. Usually, this is the same attribute used to find the user account, such as the value set as the uid in AM. For example, where the attribute is set to mail, the LDAP module searches CN=Users,DC=example,DC=com with a filter "(MAIL=bjensen@example.com)", and the directory returns the user profile that matches MAIL=bjensen@example.com.

The attributes specified in this list define the LDAP search filter. Multiple attribute values mean the user can authenticate with any one of the values. For example, if you have both uid and mail, then Barbara Jensen can authenticate with either bjensen or bjensen@example.com.

The User Search Filter text box provides a more complex filter. For example, if you search using mail and add the User Search Filter (objectClass=inetOrgPerson), then AM uses the resulting search filter (&(mail=address)(objectClass=inetOrgPerson)), where address is the mail address provided by the user.

This attribute defines the level of directory that will be searched for a matching profile. You can set the search to run at a high level or against a specific area:

If you want to initiate secure communications to data stores using SSL or StartTLS, AM must be able to trust the server’s certificates, either because the certificates were signed by a CA whose certificate is already included in the trust store used by the container where AM runs, or because you imported the certificates into the trust store.

If User Profile is set to Required, this attribute determines whether the DN or the username is returned as the authentication principal.

This list of attributes defines the mapping of internal attribute names to external attribute names for dynamic profile creation. The attributes retrieved from the user’s authenticated profile are mapped against the values that will be provisioned into their matching account in the data store. This list does not include uid mappings.

Set the minimum length required for a valid password when a user needs to reset their password during authentication.

Determines whether LDAP Behera password policies are supported by a directory server such as ForgeRock Directory Services. If the property is set to false, then only the older Netscape VCHU password policy standard will be enforced.

When enabled, the module trusts all server certificates, including self-signed certificates.

Specifies how often AM should send a heartbeat request to the directory server to ensure that the connection does not remain idle. Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. You can turn this off by setting the value to 0. To set the units for the interval, use LDAP Connection Heartbeat Time Unit.

Specifies the time unit corresponding to LDAP Connection Heartbeat Interval. Possible values are SECONDS, MINUTES, and HOURS.

Defines the timeout, in seconds, that AM should wait for a response from the directory server.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

If enabled, prevent AM from sending further bind requests to the LDAP Server when the user is locked out through a duration lockout.

Specifies the OAuth 2.0 client_id parameter as described in section 2.2 of RFC 6749.

Specifies the OAuth 2.0 client_secret parameter as described in section 2.3 of RFC 6749.

Specifies the URL to the endpoint handling OAuth 2.0 authentication as described in section 3.1 of RFC 6749.

Specifies the URL to the endpoint handling access tokens as described in section 3.2 of RFC 6749.

Specifies the user profile URL that returns profile information in JSON format.

Specifies a space-delimited list of user profile attributes that the client application requires, according to The OAuth 2.0 Authorization Framework. The list depends on the permissions that the resource owner, such as the end user, grants to the client application.

Specifies the name of the parameter that contains the access token value when accessing the profile service.

Sets the URL to the /oauth2c/OAuthProxy.jsp file, which provides AM with GET to POST proxying capabilities. Change this URL only if an external server performs the GET to POST proxying.

Specifies the name of the class that implements the account provider.

Specifies the name of the class that implements the attribute mapping for the account search.

Specifies the attribute configuration used to map the account of the user authenticated in the OAuth 2.0 provider to the local data store in AM. Valid values are in the form provider-attr=local-attr.

{
  "sub" : "12345",
  "name" : {
    "first_name" : "Demo",
    "last_name" : "User"
  }
}

Specifies the list of fully qualified class names for implementations that map attributes from the OAuth 2.0 authorization server or OpenID Connect provider to AM profile attributes.

org.forgerock.openam.authentication.modules.oidc.JsonAttributeMapper

Map of OAuth 2.0 provider user account attributes to local user profile attributes, with values in the form provider-attr=local-attr.

{
  "sub" : "12345",
  "name" : {
    "first_name" : "Demo",
    "last_name" : "User"
  }
}

When enabled, saves the attributes in the Attribute Mapper Configuration field to the AM session.

Specifies the attribute identifying the authenticated user’s email address in the response from the profile service in the OAuth 2.0 provider. This setting is used to send an email message with an activation code for accounts created dynamically.

When enabled, AM creates an account for the user if the user profile does not exist. If the Prompt for password setting and activation code attribute is enabled, AM prompts the user for a password and activation code before creating the account.

When enabled, the user must set a password before AM creates an account dynamically. An activation code is also sent to the user’s email address. Both the password and the code are required before the account is created.

When enabled, maps the OAuth 2.0 authenticated user to the specified anonymous user. If the Create account if it does not exist property is enabled, AM creates an account for the authenticated user instead of mapping the account to the anonymous user.

Specifies an anonymous user that exists in the current realm. The user status of this anonymous user must be Active. The Map to anonymous user property maps authorized users without a profile to this anonyomus user, if enabled.

Specifies the optional URL of the OAuth 2.0 provider’s logout service, if required.

Specifies whether not to log the user out without prompting from the OAuth 2.0 provider on logout, to log the user out without prompting, or to prompt the user regarding whether to log out from the OAuth 2.0 provider.

Specifies the class used by the module to send email. A custom subclass of org.forgerock.openam.authentication.modules.oauth2.EmailGateway class can be provided.

Specifies the host name of the mail server.

Specifies the SMTP port number for the mail server.

Specifies the username and password AM uses to authenticate to the mail server.

When enabled, connects to the mail server over SSL. AM must be able to trust the SMTP server certificate.

Specifies the address of the email sender, such as no-reply@example.com.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Validates the ID token from the OpenID Connect provider. The module needs either a URL to get the public keys for the provider or the symmetric key for an ID token signed with a HMAC-based algorithm.

Edit this field depending on the Configuration type you specified in the OpenId Connect validation configuration type field.

Required when the openid scope is included. Value must match the iss field in the issued ID token. For example, accounts.google.com.

Specifies a list of IP addresses of trusted clients that can access MSISDN modules. Either restrict the clients allowed to access the MSISDN module by adding each IPv4 or IPv6 address here, or leave the list empty to allow all clients to access the module. If you specify the value none, no clients are allowed access.

Specifies a list of parameter names that identify which parameters to search in the request header or cookie header for the MSISDN number. For example, if you define x-Cookie-Param, AM_NUMBER, and COOKIE-ID, the MSISDN authentication service checks those parameters for the MSISDN number.

Specifies the LDAP server FQDN and its port in the format ldap-server:port. AM servers can be paired with LDAP servers and ports by adding entries of the form AM-server|ldap_server:port, for example, openam.example.com|ldap1.example.com:649.

Specifies the DN of the entry where the search for the user’s MSISDN number should start. AM servers can be paired with search base DNs by adding entries with the format AM-server|base-dn. For example, openam.example.com|dc=openam,dc=forgerock,dc=com.

Specifies the name of the attribute in the user’s profile that contains the MSISDN number to search for the user. The default is sunIdentityMSISDNNumber.

Specifies the bind DN and password of the service account AM uses to authenticate to the directory server. The default is uid=admin.

When enabled, AM uses LDAPS or StartTLS to connect to the directory server. If you choose to enable SSL or TLS, then make sure that AM can trust the servers' certificates.

Specifies which elements are searched for the MSISDN number. The possible values are:

Specify the LDAP attribute that is used during a search to return the user profile for MSISDN authentication service. The default is uid.

When enabled, this option allows the authentication module to return the DN instead of the User ID. AM thus does not need to perform an additional search with the user ID to find the user’s entry.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the length of the OTP to six digits or longer. The default value is six.

The minimum number of hexadecimal characters allowed for the secret key.

The name of the attribute where the key will be stored in the user profile.

Select whether to use HOTP or TOTP. You can create an authentication chain to allow for a greater variety of devices. The default value is HOTP.

The window that the OTP device and the server counter can be out of sync. For example, if the window size is 100 and the server’s last successful login was at counter value 2, then the server will accept an OTP from device counter 3 to 102. The default value is 100.

The name of the HOTP attribute where the counter will be stored in the user profile.

Adds a checksum digit at the end of the HOTP password to verify the OTP was generated correctly. This is in addition to the actual password length. Set this only if your device supports it. The default value is No.

Advanced feature that is device-specific. Let this value default unless you know your device uses a truncation offset. The default value is -1.

The time interval for which an OTP is valid. For example, if the time step interval is 30 seconds, a new OTP will be generated every 30 seconds, and an OTP will be valid for 30 seconds. The default value is 30 seconds.

The number of times entry of the OTP may be attempted. Minimum is 1, maximum is 10.

The number of time step intervals that the system and the device can be off before password resynchronization is required. For example, if the number of TOTP time steps is 2 and the TOTP time step interval is 30 seconds, the server will allow an 89 second clock skew between the client and the server—two 30 second steps plus 29 seconds for the interval in which the OTP arrived. The default value is 2.

The name of the attribute where both HOTP and TOTP authentication will store information on when a person last logged in.

The class that processes the user profile attribute where the user’s secret key is stored. The name of this attribute is specified in the Secret Key Attribute Name property.

The user profile attribute where the clock drift is stored. If this field is not specified, then AM does not check for clock drift.

The maximum acceptable clock drift before authentication fails. If this value is exceeded, the user must register their device again.

The account provider provides the means to search for and create OpenID Connect users given a set of attributes.

In order to validate the ID token from the OpenID Connect provider, the module needs either a URL to get the public keys for the provider, or the symmetric key for an ID token signed with a HMAC-based algorithm; AM ignores keys specified in JWT headers, such as `jku` and `jwe`.

Specifies the discovery URL, JWK or the client secret corresponding to the configuration type selected in the OpenID Connect validation configuration type property.

Specifies the name of the HTTP request header to search for the ID token.

Corresponds to the expected issue identifier value in the iss field of the ID token.

Maps OpenID Connect ID token claims to local user profile attributes, allowing the module to retrieve the user profile based on the ID token.

Specifies a case-sensitive audience name for this OpenID Connect authentication module. Used to check that the ID token received is intended for this module as an audience.

Specifies a list of case-sensitive strings and/or URIs from which this authentication module accepts ID tokens. This list is checked against the authorized party claim of the ID token.

Specifies the class that implements the mapping of the OpenID Connect end user to an AM account. The default principal mapper uses the mapping of local attributes to ID token attributes to find a user profile.

Specifies the maximum idle time between requests in hours. If that time is exceeded, the cookie is no longer valid.

Specifies the maximum life of the cookie in hours.

When enabled, enforces that the persistent cookie can only be used from the same client IP to which the cookie was issued.

When enabled, adds the "Secure" attribute to the persistent cookie.

When enabled, adds the HttpOnly attribute to the persistent cookie.

Set the name of the persistent cookie.

Specify one or more primary and secondary RADIUS servers.

Specify the shared secret for RADIUS authentication. The shared secret should be as secure as a well-chosen password.

Specify the RADIUS server port.

Specify how many seconds to wait for the RADIUS server to respond. The default value is 3 seconds.

Used for failover. Specify how often AM performs a health check on a previously unavailable RADIUS server by sending an invalid authentication request.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Specifies the identity provider (IDP) for authentication requests to this module. Specify the name of a SAML v2.0 entity provider that is defined in the SAML2 authentication module’s realm.

Specifies the local alias for the service provider (SP).

Specifies whether the IDP should create a new identifier for the authenticating user if none exists.

Specifies an authentication chain that is invoked when a user requires authentication to the SP.

Specifies a comparison method to evaluate authentication context classes or statements. The value specified in this property overrides the value set in the SP configuration under Realms > Realm Name > Applications > Federation > Entity Providers > Service Provider Name > Assertion Content > Authentication Context > Comparison Type.

Specifies one or more URIs for authentication context classes to be included in the SAML request. Authentication context classes are unique identifiers for an authentication mechanism. The SAML v2.0 protocol supports a standard set of authentication context classes, defined in Authentication Context for the OASIS Security Assertion Markup Language (SAML) V2.0. In addition to the standard authentication context classes, you can specify customized authentication context classes.

Specifies one or more URIs that identify authentication context declarations.

Specifies the format used to send the authentication request from the SP to the IDP.

Specifies the format used to send the response from the IDP to the SP.

Specifies whether the IDP should force authentication or can reuse existing security contexts.

Specifies whether the IDP should use passive authentication or not. Passive authentication requires the IDP to only use authentication methods that do not require user interaction. For example, authenticating using an X.509 certificate.

Specifies a SAML name ID format to be requested in the SAML authentication request.

Specifies whether AM should attempt to log out of the user’s IDP session during session logout.

Specifies the URL to which the user is forwarded after successful IDP logout. Configure this property only if you have enabled SAML v2.0 single logout by selecting the Single Logout Enabled check box.

When enabled, the module includes the specified client-side script in the login page to be executed on the user-agent prior to the server-side script.

Specifies the ID of the script to include in the login page. This script is run on the user-agent prior to the server-side script. This script must be written in a language the user-agent can interpret, such as JavaScript, even if the server-side script is written in Groovy.

Specifies the ID of the script to run in AM after the client-side script has completed.

Sets the authentication level used to indicate the level of security associated with the scripted authentication module.

Specifies the maximum execution time any individual script should take on the server (in seconds). AM terminates scripts which take longer to run than this value.

Specifies the initial number of threads in the thread pool from which scripts operate. AM will ensure the pool contains at least this many threads.

Specifies the maximum number of threads in the thread pool from which scripts operate. If no free thread is available in the pool, AM creates new threads in the pool for script execution up to the configured maximum. It is recommended to set the maximum number of threads to 300.

Specifies the number of threads to use for buffering script execution requests when the maximum thread pool size is reached.

Specifies the length of time (in seconds) for a thread to be idle before AM terminates created threads. If the current pool size contains the number of threads set in Core thread pool size, then idle threads will not be terminated, maintaining the initial pool size.

Specifies the list of class name patterns allowed to be invoked by the script. Every class accessed by the script must match at least one of these patterns.

Specifies the list of class name patterns that are NOT allowed to be invoked by the script. The denylist is applied AFTER the allowlist to exclude those classes. Access to a class specified in both the allowlist and the denylist will be denied.

When enabled, AM makes a call to the System.getSecurityManager().checkPackageAccess(…​) method for each class that is accessed. The method throws SecurityException if the calling thread is not allowed to access the package.

Specify the directory where the SecurID ACE/Server sdconf.rec file is located, which by default is expected under the AM configuration directory, such as /path/to/openam/config/auth/ace/data. The directory must exist before AM can use SecurID authentication.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

Specifies the Kerberos principal for authentication in the format HTTP/host.domain@DC-DOMAIN-NAME, where host.domain corresponds to the host and domain names of the AM instance and DC-DOMAIN-NAME is the domain name of the Kerberos realm (the FQDN of the Active Directory domain). DC-DOMAIN-NAME can differ from the domain name for AM.

Specifies the full path of the keytab file for the Service Principal. You generate the keytab file using the Windows ktpass utility.

Specifies the Kerberos Key Distribution Center realm. For the Windows Kerberos service, this is the domain controller server domain name.

Specifies the fully qualified domain name of the Kerberos Key Distribution Center server, such as that of the domain controller server.

When enabled, AM automatically returns the Kerberos principal with the domain controller’s domain name during authentication.

Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

List of trusted Kerberos realms for user Kerberos tickets. If realms are configured, then Kerberos tickets are only accepted if the realm part of the user principal name of the user’s Kerberos ticket matches a realm from the list.

Configuration used for the JDK Kerberos LoginModule (Krb5LoginModule), which authenticates users using Kerberos principals. Possible values are true for initiator credentials, and false for acceptor credentials.

Validates the user against the configured data stores. If the user from the Kerberos token is not found, authentication will fail. If an authentication chain is set, the user is able to authenticate through another module. This search uses the Alias Search Attribute Name from the core realm attributes. See User Profile for more information about this property.