--- title: Secret label default mappings description: Reference list of PingAM secret labels used by features and their default mappings, organized by feature area such as authentication, OAuth 2.0, SAML 2.0, UMA, and agents. component: pingam version: 8.1 page_id: pingam:security:secret-label-mappings canonical_url: https://docs.pingidentity.com/pingam/8.1/security/secret-label-mappings.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-10-19T15:00:46Z keywords: ["Security", "Setup & Configuration"] section_ids: general-default-secret-labels: General attestation-secret-IDs: Attestation certificates authentication-default-secret-IDs: Authentication device-storage-secret-labels: Encrypted device storage services httpclient-secret-labels: Http Client service iot-default-secret-IDs: IoT oauth2-default-secret-IDs: OAuth 2.0 and OpenID Connect oauth2-provider-default-secret-IDs: As provider oidc-social-registration-secret-IDs: As client/relying party of the Social Identity Provider service policy-config-service-default-secret-IDs: Policy Configuration service push-notification-service-default-secret-IDs: Push Notification service saml2-default-secret-IDs: SAML 2.0 uma-secret-labels: UMA user-self-service-secret-labels: User self-service agents-default-secret-IDs: Web agents and Java agents --- # Secret label default mappings The following sections list the secret labels used by the AM features and their default mappings, if any. ## General > **Collapse: PEM decryption password** > > The following table shows the secret label in which you can store the password used to decrypt password-encrypted PEM files. > > Encode the password using the `https://am.example.com:8443/am/encode.jsp` page. > > | Secret label | Default alias | Algorithms | > | ------------------------------------------- | ------------- | ------------------------- | > | `am.global.services.secrets.pem.decryption` | | Encode using `encode.jsp` | > **Collapse: Encrypt client-side sessions** > > The following table shows the secret label mapping to use when encrypting [client-side](../am-sessions/client-based-sessions.html) sessions: > > | Secret label | Default alias | Algorithms | > | ---------------------------------------------------------- | ------------- | ---------- | > | `am.global.services.session.clientbased.encryption.RSA` | | RS256 | > | `am.global.services.session.clientbased.encryption.AES`(1) | `aestest` | AES256 | > | `am.global.services.session.clientbased.encryption`(2) | `test` | RS256 | > > (1) This secret label replaces the legacy Encryption Symmetric AES Key configuration property (under Configure > Global Services > Sessions > Advanced). If you set both the configuration property *and* the secret label mapping, the mapping takes precedence. > > (2) This secret label is deprecated and will be removed in a future release. Use the algorithm-specific secret labels in this table instead. These secret labels make it easier to configure and rotate secrets. > **Collapse: Sign client-side sessions** > > The following table shows the secret label mapping to use when signing [client-side](../am-sessions/client-based-sessions.html) sessions: > > | Secret label | Default alias | Algorithms | > | -------------------------------------------------------- | ------------------ | ----------------------- | > | `am.global.services.session.clientbased.signing.RSA` | | RS256 | > | `am.global.services.session.clientbased.signing.ES256` | | ES256 | > | `am.global.services.session.clientbased.signing.ES384` | | ES384 | > | `am.global.services.session.clientbased.signing.ES512` | | ES512 | > | `am.global.services.session.clientbased.signing.HMAC`(1) | `hmacsigningtest` | HMAC | > | `am.global.services.session.clientbased.signing`(2) | `rsajwtsigningkey` | RS256 ES256 ES384 ES512 | > > (1) This secret label replaces the legacy Signing HMAC Shared Secret configuration property (under Configure > Global Services > Sessions > Advanced). If you set both the configuration property *and* the secret label mapping, the mapping takes precedence. > > (2) This secret label is deprecated and will be removed in a future release. Use the algorithm-specific secret labels in this table instead. These secret labels make it easier to migrate and rotate secrets. If you set this secret label *and* an algorithm-specific secret label, the algorithm-specific label takes precedence. > **Collapse: mTLS certificate for the CRL cache server** > > The secret label mapping to encrypt the certificate used to authenticate to the CRL cache server. > > Learn more about CRL caching in [Certificate revocation list caching](../setup/deployment-configuration-reference.html#security-revocation). > > | Secret label | Default alias | Algorithms | > | ------------------------------------------ | ------------- | ---------- | > | `am.servers.crl.cache.directory.mtls.cert` | | | > **Collapse: HTTP client proxy password secret** > > The secret label mapping for the HTTP client proxy password used to authenticate HTTP outbound requests. > > | Secret label | Default alias | Algorithms | > | ------------------------------------------- | ------------- | ---------- | > | `am.servers.httpclienthandler.proxy.secret` | | | > **Collapse: WebAuthn Metadata** > > AM verifies the FIDO metadata blob signature against secrets mapped to this secret label. > > | Secret label | Default alias | Algorithms | > | ---------------------------------------------------------------------- | ------------- | ---------- | > | `am.authentication.nodes.webauthn.fidometadataservice.rootcertificate` | | | ## Attestation certificates > **Collapse: Google hardware attestation root certificate** > > This table shows the ID for the Google hardware attestation root certificate. > > This certificate is used to confirm the keys used by bound Android devices are valid, have not been revoked, and use hardware-backed security storage. > > Refer to [Verifying hardware-backed key pairs with Key Attestation](https://developer.android.com/training/articles/security-key-attestation#root_certificate) in the Android developer documentation. > > | Secret label | Default alias | Algorithms | > | ------------------------------------------- | ------------- | ----------- | > | `am.services.attestation.google.public.key` | | RSA / X.509 | ## Authentication > **Collapse: Persistent cookie nodes** > > The following table shows the secret label mappings used to encrypt and sign persistent cookies for the [Set Persistent Cookie node](https://docs.pingidentity.com/auth-node-ref/8.1/set-persistent-cookie.html) and [Persistent Cookie Decision node](https://docs.pingidentity.com/auth-node-ref/8.1/persistent-cookie-decision.html): > > | Secret label | Default alias | Algorithms | > | ----------------------------------------------------------------- | ------------- | ------------------------ | > | `am.authentication.nodes.persistentcookie.encryption` (1) | `test` | RSA (at least 2048 bits) | > | `am.authentication.nodes.persistentcookie.identifier.signing` (2) | | | > > (1) The `am.authentication.nodes.persistentcookie.encryption` label overrides the value for Persistent Cookie Encryption Certificate Alias in the [Core authentication attributes](../am-authentication/authn-core-settings.html). > > (2) Map the `am.authentication.nodes.persistentcookie.identifier.signing` dynamic secret label to override the HMAC Signing Key node property, where identifier is the value of the HMAC Signing Key Secret Label Identifier. > > | | | > | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | > | | To read the persistent cookies generated by the [Set Persistent Cookie node](https://docs.pingidentity.com/auth-node-ref/8.1/set-persistent-cookie.html), configure the [Persistent Cookie Decision node](https://docs.pingidentity.com/auth-node-ref/8.1/persistent-cookie-decision.html) to use the same signing key secret label. | > **Collapse: Encrypt authentication tree secure state data** > > The following table shows the secret label mapping used to encrypt sensitive data stored in the secure state of an authentication tree: > > | Secret label | Default alias | Algorithms | > | ------------------------------------------ | --------------- | ----------- | > | `am.authn.trees.transientstate.encryption` | `directenctest` | AES 256-bit | > **Collapse: Sign authentication requests** > > The secret label mappings for the HMAC secret used to sign and verify the authentication token (`authID`): > > | Secret label | Default alias | Algorithms | > | ------------------------------ | ----------------- | ---------- | > | `am.authn.authid.signing.HMAC` | `hmacsigningtest` | | > > This mapping overrides the randomly-generated core authentication attribute, `Organization Authentication Signing Secret`. > > You can map multiple secrets to this label to enable secret rotation. AM signs the authentication token with the *active* secret but checks all mapped secrets when verifying the authentication token signature. Therefore, if you rotate the active secret while an authentication request is in progress, the returned authentication token can still be verified. > > If you *delete* the secret that was used to sign an authentication token, the `authID` returned in the authentication request can't be verified and authentication fails. > **Collapse: Authentication nodes** > > The dynamic secret labels for authentication nodes, where identifier is defined in the node configuration: > > | Node | Secret label | > | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | > | [AD Decision node](https://docs.pingidentity.com/auth-node-ref/8.1/ad-decision.html) | `am.authentication.nodes.ad.decision.mtls.identifier.cert` | > | [CAPTCHA node](https://docs.pingidentity.com/auth-node-ref/8.1/captcha.html) | `am.authentication.nodes.captcha.identifier.secret` | > | [Certificate Validation node](https://docs.pingidentity.com/auth-node-ref/8.1/certificate-validation.html) | `am.authentication.nodes.certificate.validation.mtls.identifier.cert` | > | [JWT Password Replay node](https://docs.pingidentity.com/auth-node-ref/8.1/jwt-password-replay.html) | `am.authentication.nodes.jwt.replay.identifier.encryption` | > | [LDAP Decision node](https://docs.pingidentity.com/auth-node-ref/8.1/ldap-decision.html) | `am.authentication.nodes.ldap.decision.mtls.identifier.cert` | > | [OTP Email Sender node](https://docs.pingidentity.com/auth-node-ref/8.1/otp-email-sender.html) | `am.authentication.nodes.otp.mail.identifier.password` | > | [OTP SMS Sender node](https://docs.pingidentity.com/auth-node-ref/8.1/otp-sms-sender.html) | `am.authentication.nodes.otp.sms.identifier.password` | > | [Persistent Cookie Decision node](https://docs.pingidentity.com/auth-node-ref/8.1/persistent-cookie-decision.html) [Set Persistent Cookie node](https://docs.pingidentity.com/auth-node-ref/8.1/set-persistent-cookie.html) | `am.authentication.nodes.persistentcookie.identifier.signing` | > | [RADIUS Decision node](https://docs.pingidentity.com/auth-node-ref/8.1/radius-decision.html) | `am.authentication.nodes.radius.identifier.secret` | > | [reCAPTCHA Enterprise node](https://docs.pingidentity.com/auth-node-ref/8.1/recaptcha-enterprise.html) | `am.authentication.nodes.captchaEnterprise.identifier.secret` | > | [RSA SecurID node](https://docs.pingidentity.com/auth-node-ref/8.1/rsa-securid.html) | `am.authentication.nodes.securid.identifier.client.key` | > | [WebAuthn Registration node](https://docs.pingidentity.com/auth-node-ref/8.1/webauthn-registration.html) | `am.authentication.nodes.webauthn.truststore.identifier` | ## Encrypted device storage services > **Collapse: Encrypt device storage services** > > The secret label mappings for services that use encrypted device storage. > > These mappings override the encryption keys set in the service configuration. > > | Service | Secret label | > | --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | > | [Device ID Service](../setup/services-configuration.html#global-deviceidservice) | `am.services.deviceid.encryption` | > | [Device Binding Service](../setup/services-configuration.html#global-devicebindingservice) | `am.services.devicebinding.encryption` | > | [Device Profile Service](../setup/services-configuration.html#global-deviceprofilesservice) | `am.services.deviceprofiles.encryption` | > | [WebAuthn Profile Encryption Service](../setup/services-configuration.html#global-authenticatorwebauthnservice) | `am.services.authenticatorwebauthn.encryption` | > | [ForgeRock Authentication (OATH) Service](../setup/services-configuration.html#global-authenticatoroathservice) | `am.services.authenticatoroath.encryption` | > | [ForgeRock Authentication (PUSH) Service](../setup/services-configuration.html#global-authenticatorpushservice) | `am.services.authenticatorpush.encryption` | ## Http Client service > **Collapse: HTTP client mTLS certificates** > > The following table shows the secret label mappings for CA certificates used by the [httpclient](../am-scripting/script-bindings.html#common-httpclient) script binding to secure HTTP requests. > > | Secret label | Default alias | Algorithms | > | ------------------------------------------------------------------- | ------------- | ---------- | > | `am.services.httpclient.mtls.clientcert.identifier.secret`(1) | | | > | `am.services.httpclient.mtls.servertrustcerts.identifier.secret`(2) | | | > > (1) Map the `am.services.httpclient.mtls.clientcert.identifier.secret` dynamic secret label to the certificate to be used by the `httpclient` script binding when making HTTP requests. The identifier is the value of the Client Certificate Secret Label Identifier set in the HTTP Client service configuration. > > (2) Map the `am.services.httpclient.mtls.servertrustcerts.identifier.secret` dynamic secret label to the truststore of certificates that verify the server certificate. The identifier is the value of the Server Trust Certificate Secret Label Identifier set in the HTTP Client service configuration. > **Collapse: HTTP client proxy connection** > > The following table shows the secret label mappings used by the [httpclient](../am-scripting/script-bindings.html#common-httpclient) script binding to route HTTP requests through a proxy connection. > > | Secret label | Default alias | Algorithms | > | --------------------------------------------------- | ------------- | ---------- | > | `am.services.httpclient.proxy.identifier.secret`(1) | | | > > (1) Map the `am.services.httpclient.proxy.identifier.secret` dynamic secret label to the secret to be used by the `httpclient` script binding when making HTTP requests. The identifier is the value of the Proxy Secret Label Identifier set in the HTTP Client service configuration. ## IoT > **Collapse: IoT trusted JWT issuer** > > The following table shows the secret label mapping that the IoT service uses when configured as a trusted OAuth 2.0 JWT issuer: > > | Secret label | Default alias | Algorithms | > | ------------------------------------ | ----------------- | ---------- | > | `am.services.iot.jwt.issuer.signing` | `hmacsigningtest` | HS256 | > **Collapse: IoT certificate verification** > > The following table shows the secret label mapping for the CA certificate that the [Register Thing node](https://docs.pingidentity.com/auth-node-ref/8.1/self-managed/register-thing.html) uses to verify the X.509 digital certificate included in the proof-of-possession JWT: > > | Secret label | Default alias | Algorithms | > | ----------------------------------- | ------------- | ---------- | > | `am.services.iot.cert.verification` | | | ## OAuth 2.0 and OpenID Connect ### As provider > **Collapse: JWT authenticity signing** > > The following table shows the secret label mapping used to sign several OAuth 2.0 and OpenID Connect-related JWTs: > > | Secret label | Default alias | Algorithms | > | --------------------------------------------- | ----------------- | ----------------- | > | `am.services.oauth2.jwt.authenticity.signing` | `hmacsigningtest` | HS256 HS384 HS512 | > > | | | > | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | > | | This key is used to sign the following tokens and requests:- OpenID Connect tokens for web and Java agents. > > - OpenID Connect tokens that are signed with an HMAC algorithm. > > - Macaroon access and refresh tokens. > > - Consent requests to remote consent agents that are signed with an HMAC algorithm. | > **Collapse: Encrypt client-side OAuth 2.0 tokens** > > This table shows the secret label mapping used to encrypt [client-side](../am-oauth2/stateless-stateful-tokens.html#client-side-tokens) access tokens: > > | Secret label | Default alias | Algorithms | > | ----------------------------------------------- | --------------- | ------------- | > | `am.services.oauth2.stateless.token.encryption` | `directenctest` | A128CBC-HS256 | > **Collapse: Sign client-side OAuth 2.0 tokens** > > This table shows the secret label mappings used to sign [client-side](../am-oauth2/stateless-stateful-tokens.html#client-side-tokens) access tokens: > > | Secret label | Default alias | Algorithms | > | -------------------------------------------- | ------------------ | ----------------------------------- | > | `am.services.oauth2.stateless.signing.ES256` | `es256test` | ES256 | > | `am.services.oauth2.stateless.signing.ES384` | `es384test` | ES384 | > | `am.services.oauth2.stateless.signing.ES512` | `es512test` | ES512 | > | `am.services.oauth2.stateless.signing.HMAC` | `hmacsigningtest` | HS256 HS384 HS512 | > | `am.services.oauth2.stateless.signing.RSA` | `rsajwtsigningkey` | PS256 PS384 PS512 RS256 RS384 RS512 | > **Collapse: Authenticate OAuth 2.0 clients** > > The secret label mappings used to authenticate [OAuth 2.0 clients](../am-oauth2/oauth2-register-client.html): > > | Secret label | Default alias | Algorithms | > | --------------------------------------------------------------------- | ------------- | ---------- | > | `am.applications.oauth2.client.identifier.secret`(1) | | | > | `am.applications.oauth2.client.identifier.jwt.public.key`(2) | | | > | `am.applications.oauth2.client.identifier.mtls.trusted.cert`(3) | | | > | `am.applications.oauth2.client.identifier.id.token.enc.public.key`(4) | | | > > (1) Map the `am.applications.oauth2.client.identifier.secret` dynamic secret label to override the OAuth 2.0 client's Client secret property, where identifier is the value of the Secret Label Identifier set in the client configuration. (2) Map the `am.applications.oauth2.client.identifier.jwt.public.key` dynamic secret label to override the OAuth 2.0 client's Client JWT Bearer Public Key, where identifier is the value of the Secret Label Identifier set in the client configuration. (3) Map the `am.applications.oauth2.client.identifier.mtls.trusted.cert` dynamic secret label to override the OAuth 2.0 client's mTLS Self-Signed Certificate, where identifier is the value of the Secret Label Identifier set in the client configuration. (4) Map the `am.applications.oauth2.client.identifier.id.token.enc.public.key` dynamic secret label to override the OAuth 2.0 client's ID Token Encryption Public Key, where identifier is the value of the Secret Label Identifier set in the client configuration. > **Collapse: Sign remote consent requests** > > This table shows the secret label mappings used to sign remote consent requests: > > | Secret label | Default alias | Algorithms(1) | > | ------------------------------------------------------------- | ------------------ | ----------------------------------- | > | `am.applications.agents.remote.consent.request.signing.ES256` | `es256test` | ES256 | > | `am.applications.agents.remote.consent.request.signing.ES384` | `es384test` | ES384 | > | `am.applications.agents.remote.consent.request.signing.ES512` | `es512test` | ES512 | > | `am.applications.agents.remote.consent.request.signing.RSA` | `rsajwtsigningkey` | RS256 RS384 RS512 PS256 PS384 PS512 | > > (1) If you select an HMAC algorithm for signing consent requests (HS256, HS384, or HS512), the value of the Remote Consent Service secret property is used, instead of an entry from the secret stores. > > Because the HMAC secret is shared between AM and the remote consent client, a malicious user compromising the client could create tokens that AM would trust. To protect against misuse, AM also signs the token using a non-shared signing key configured in the `am.services.oauth2.jwt.authenticity.signing` secret label. > **Collapse: Decrypt remote consent responses** > > This table shows the secret label mapping used to decrypt remote consent responses: > > | Secret label | Default alias | Algorithms(1) | > | ------------------------------------------------------- | ------------- | ------------- | > | `am.services.oauth2.remote.consent.response.decryption` | `test` | RSA-OAEP-256 | > > (1) If you select an algorithm other than RSA-OAEP-256 for decrypting consent responses, the value of the Remote Consent Service secret property is used, instead of an entry from the secret stores. > **Collapse: OAuth 2.0 example Remote Consent service** > > This table shows the secret label mappings used for the example Remote Consent service: > > | Secret label | Default alias | Algorithms | > | -------------------------------------------------------- | -------------------- | ------------------------------------- | > | `am.services.oauth2.remote.consent.response.signing.RSA` | `rsajwtsigningkey` | RS256 RSA (at least 2048 bits) | > | `am.services.oauth2.remote.consent.request.encryption` | `selfserviceenctest` | RSA-OAEP-256 RSA (at least 2048 bits) | > **Collapse: Salt hashes** > > The secret label for salting hashes in OAuth 2.0 and OIDC flows. > > | Secret label | Default alias | Algorithms | > | ---------------------------------------------- | ------------- | ---------- | > | `am.services.oauth2.provider.hash.salt.secret` | | | > > Use this secret label instead of setting Subject Identifier Hash Salt in the provider configuration. > > This secret can't be rotated. > **Collapse: Decrypt OIDC request parameters** > > This table shows the secret label mapping used to decrypt OIDC request parameters: > > | Secret label | Default alias | Algorithms(1) | > | ------------------------------------------------- | ------------- | ------------------------------------ | > | `am.services.oauth2.oidc.decryption.RSA1.5` | `test` | RSA with PKCS#1 v1.5 padding | > | `am.services.oauth2.oidc.decryption.RSA.OAEP` | `test` | RSA with OAEP with SHA-1 and MGF-1 | > | `am.services.oauth2.oidc.decryption.RSA.OAEP.256` | `test` | RSA with OAEP with SHA-256 and MGF-1 | > > (1) The following applies to confidential clients only: > > If you select an AES algorithm (A128KW, A192KW, or A256KW) or the direct encryption algorithm (dir), the value of the Client Secret field in the OAuth 2.0 Client is used as the secret instead of an entry from the secret stores. > > The following signing and encryption algorithms use the Client Secret field to store the secret: > > * Signing ID tokens with an HMAC algorithm > > * Encrypting ID tokens with AES or direct encryption > > * Encrypting parameters with AES or direct encryption > > Store only one secret in the Client Secret field; AM will use different mechanisms to sign and encrypt depending on the algorithm, as explained in the OpenID Connect Core 1.0 errata set 1 specification. > **Collapse: Sign OIDC tokens** > > The following table shows the secret label mapping used to sign OIDC ID tokens and backchannel logout tokens: > > | Secret label | Default alias | Algorithms(1) | > | --------------------------------------- | ------------------ | ----------------------------------- | > | `am.services.oauth2.oidc.signing.ES256` | `es256test` | ES256 | > | `am.services.oauth2.oidc.signing.ES384` | `es384test` | ES384 | > | `am.services.oauth2.oidc.signing.ES512` | `es512test` | ES512 | > | `am.services.oauth2.oidc.signing.RSA` | `rsajwtsigningkey` | PS256 PS384 PS512 RS256 RS384 RS512 | > | `am.services.oauth2.oidc.signing.EDDSA` | | EdDSA with SHA-512 | > > (1) The following applies to confidential clients only: > > If you select an HMAC algorithm for signing ID tokens (HS256, HS384, or HS512), the Client Secret property value in the OAuth 2.0 Client is used as the HMAC secret instead of an entry from the secret stores. > > Since the HMAC secret is shared between AM and the client, a malicious user compromising the client could potentially create tokens that AM would trust. Therefore, to protect against misuse, AM also signs the token using a non-shared signing key configured in the `am.services.oauth2.jwt.authenticity.signing` secret label. > **Collapse: CA certificates used in mTLS client authentication** > > This table shows the secret label mapping used to store the CA certificates AM should trust during mTLS client authentication: > > | Secret label | Default alias | Algorithms | > | --------------------------------------------------- | ------------- | ---------- | > | `am.services.oauth2.tls.client.cert.authentication` | | | ### As client/relying party of the Social Identity Provider service > **Collapse: Decrypt ID tokens** > > This table shows the secret label mapping to support decryption of ID tokens and `userinfo` endpoint data in JWT format when AM is configured as a relying party of the Social Identity Provider Service: > > | Secret label | Default alias | Algorithms | > | ----------------------------------------------- | ------------- | ------------------------------------------------------------ | > | `am.services.oauth2.oidc.rp.idtoken.encryption` | `test` | Consult the `.well-known` endpoint of the identity provider. | > > The public key is exposed in the [/oauth2/connect/rp/jwk_uri](../am-oidc1/managing-rp-jwk_uri.html). > > For more information about the algorithms supported, and how to configure this secret label mapping, refer to [Social authentication](../am-authentication/social-registration.html). > **Collapse: Sign JWTs and objects** > > This table shows the secret label mapping that AM uses to sign JWTs and objects when configured as a relying party of the Social Identity Provider Service: > > | Secret label | Default alias | Algorithms | > | ----------------------------------------------------- | ------------------ | ------------------------------------------------------------ | > | `am.services.oauth2.oidc.rp.jwt.authenticity.signing` | `rsajwtsigningkey` | Consult the `.well-known` endpoint of the identity provider. | > > The public key is exposed in the [/oauth2/connect/rp/jwk_uri](../am-oidc1/managing-rp-jwk_uri.html). > > For more information about the algorithms supported, and how to configure this secret label mapping, refer to [Social authentication](../am-authentication/social-registration.html). > **Collapse: CA certificates used in mTLS client authentication (RP)** > > The following table shows the secret label mapping used to store CA or self-signed certificates AM uses for mTLS client authentication when configured as a relying party of the Social Identity Provider service: > > | Secret label | Default alias | Algorithms | > | ---------------------------------------------------- | ------------- | ------------------------------------------------------------ | > | `am.services.oauth2.mtls.client.cert.authentication` | | Consult the `.well-known` endpoint of the identity provider. | > > The public key is exposed in the [/oauth2/connect/rp/jwk_uri](../am-oidc1/managing-rp-jwk_uri.html). > > For more information about the algorithms supported, and how to configure this secret label mapping, refer to [Social authentication](../am-authentication/social-registration.html). ## Policy Configuration service > **Collapse: Policy Configuration service** > > The secret label mappings to encrypt the certificate used to authenticate Policy Configuration service connections: > > | Secret label | Default alias | Algorithms | > | ------------------------------------------- | ------------- | ---------- | > | `am.policy.configuration.service.mtls.cert` | | | ## Push Notification service > **Collapse: Push Notification service** > > The secret label mapping for the Amazon Simple Notification Service access key used by the Push Notification service. The secret mapping overrides the SNS Access Key Secret set in the service configuration. > > | Secret label | Default alias | Algorithms | > | --------------------------------------------------- | ------------- | ---------- | > | `am.services.pushnotification.sns.accesskey.secret` | | | ## SAML 2.0 > **Collapse: Encrypt SAML 2.0 session storage JWTs** > > This table shows the secret label mapping used to encrypt the JWTs SAML 2.0 creates in session storage: > > | Secret label | Default alias | Algorithms | > | -------------------------------------------------------- | --------------- | ---------- | > | `am.global.services.saml2.client.storage.jwt.encryption` | `directenctest` | A256GCM | > **Collapse: Sign SAML 2.0 metadata** > > This table shows the secret label mappings used to sign SAML 2.0 metadata: > > | Secret label | Default alias | Algorithms | > | ---------------------------------------- | ------------------ | ----------- | > | `am.services.saml2.metadata.signing.RSA` | `rsajwtsigningkey` | RSA SHA-256 | > **Collapse: SAML 2.0 signing and encryption** > > The following table shows the secret label mappings used to sign and encrypt SAML 2.0 elements, and to enable mTLS authentication between entity providers: > > | Secret label | Default alias | Algorithms | > | --------------------------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------ | > | `am.default.applications.federation.entity.providers.saml2.idp.encryption` | `test` | RSA with PKCS#1 v1.5 padding RSA with OAEP | > | `am.default.applications.federation.entity.providers.saml2.idp.signing` | `rsajwtsigningkey` | RSA SHA-1(1) ECDSA SHA-256 ECDSA SHA-384 ECDSA SHA-512 RSA SHA-256 RSA SHA-384 RSA SHA-512 DSA SHA-256 | > | `am.default.applications.federation.entity.providers.saml2.sp.encryption` | `test` | RSA with PKCS#1 v1.5 padding RSA with OAEP | > | `am.default.applications.federation.entity.providers.saml2.sp.signing` | `rsajwtsigningkey` | RSA SHA-1(1) ECDSA SHA-256 ECDSA SHA-384 ECDSA SHA-512 RSA SHA-256 RSA SHA-384 RSA SHA-512 DSA SHA-256 | > | `am.default.applications.federation.entity.providers.saml2.sp.mtls`(2) | | | > | `am.applications.federation.entity.providers.saml2.identifier.basicauth`(3) | | | > > (1) This algorithm is for compatibility purposes only. Avoid its use. > > (2) For artifact resolution requests only, the SP uses the certificates mapped to this secret label for mTLS authentication to the remote IdP. These certificates are exported with `` in the SP metadata. > > (3) The SP uses the certificate mapped to this secret label for basic authentication. If you set a Secret Label Identifier, and AM finds a mapping to `am.applications.federation.entity.providers.saml2.identifier .basicauth`, AM uses this secret and ignores the value of the Password field. For basic authentication, there is no *default* secret label for the realm, or globally. > > You can specify a custom Secret Label Identifier for each SAML 2.0 entity provider in a realm. AM generates new secret labels that can be unique to the provider, or shared by multiple providers. > > For example, you could add a custom secret label identifier named *mySamlSecrets* to a hosted identity provider. AM then dynamically creates the following secret labels, which the hosted identity provider uses for signing and encryption: > > * `am.applications.federation.entity.providers.saml2.mySamlSecrets.signing` > > * `am.applications.federation.entity.providers.saml2.mySamlSecrets.encryption` > > AM attempts to look up the secrets with the custom secret label identifier. If unsuccessful, AM looks up the secrets using the default secret labels. ## UMA > **Collapse: UMA persisted claims tokens** > > The secret label mappings to encrypt UMA persisted claims tokens (PCTs): > > | Secret label | Default alias | Algorithms | > | -------------------------------- | --------------- | ---------- | > | `am.services.uma.pct.encryption` | `directenctest` | | ## User self-service > **Collapse: User self-service** > > The secret label mappings to encrypt and sign the user self-service snapshot token. > > | Secret label | Default alias | Algorithms | > | ------------------------------------------ | -------------------- | ---------- | > | `am.services.selfservice.token.encryption` | `selfserviceenctest` | | > | `am.services.selfservice.token.signing` | `rsajwtsigningkey` | | ## Web agents and Java agents > **Collapse: Sign JWTs for Web and Java agents** > > The following table shows the secret label mapping used sign the JWTs provided to web and Java agents: > > | Secret label | Default alias | Algorithms | > | ------------------------------------------------------ | ------------------ | ----------------- | > | `am.global.services.oauth2.oidc.agent.idtoken.signing` | `rsajwtsigningkey` | RS256 RS384 RS512 |