PingDirectory

Import the appropriate LDAP schema to the directory server before saving the configuration. The LDAP Bind DN service account must have the required privileges to perform this operation.

Learn more in Prepare identity stores.

An ordered list of directory servers. The format is HOST:PORT[|SERVERID[|SITEID]], where HOST:PORT are the directory server FQDN and its port, and SERVERID and SITEID are optional parameters for deployments with multiple servers and sites.

Multiple servers must be comma-separated, for example, ldap1.example.com:1636, ldap2.example.com:1636.

AM uses the optional settings to determine which directory server to contact first. AM tries to contact directory servers in the following priority order, with highest priority first:

If the directory server isn’t available, AM proceeds to the next directory server in the list.

In production environments, you should specify more than one directory server for failover purposes.

Default: host:port of the initial directory server configured for this AM server.

Bind DN of the service account AM uses to connect to the directory server. Some AM capabilities require write access to directory entries.

Bind password for connecting to the directory server.

When the force-change-on-reset password policy is configured on the PingDirectory user datastore, users resetting their passwords using AM’s forgotten password feature might be required to reset their passwords twice (prompted by both AM’s User Self-Service and PingDirectory’s password policy).

If you enable Proxied Authorization using Bind DN, AM uses PingDirectory’s proxied authorization to reset user passwords. This means AM performs the password reset as the user, so users don’t have to reset their passwords again.

Before enabling this setting, ensure that the service account configured in the LDAP Bind DN property has the proxied-auth privilege granted. If the service account doesn’t have the required privilege, users won’t be able to reset their passwords and AM and PingDirectory will log an error message.

Enable this property only if:

Default: Disabled

Enable this setting to fallback and retry using non-proxied authorization (without the PingDirectory proxied-auth privilege) when proxied authorization is denied.

Enabling this property causes AM to attempt to make LDAP changes as the LDAP Bind DN service account if proxied authorization was unsuccessful. For example, if the user account attempting the changes originally is locked or the password has expired.

This setting is effective only when Proxied Authorization using Bind DN is also enabled.

Default: Disabled

The base DN under which to find user and group profiles.

Ensure that the identity store is set up with the specified DN before making any changes to this property in AM.

Default: base-dn

Whether to use LDAP, LDAPS or StartTLS to connect to the directory server. When LDAPS or StartTLS are enabled, AM must be able to trust server certificates, either because the server certificates were signed by a CA whose certificate is already included in the trust store used by the container where AM runs, or because you imported the certificates into the trust store.

Possible values: LDAP, LDAPS, and StartTLS

Whether AM trusts all server certificates when LDAPS or StartTLS are used to connect to the directory server.

Only enable this property if you completely trust the directory server.

Default: Disabled

Minimum number of connections to the directory server.

Default: 1

Maximum number of connections to the directory server. Make sure the directory service can cope with the maximum number of client connections across all servers.

Default: 10

How often to send a heartbeat request to the directory server to ensure that the connection doesn’t remain idle. Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. You can turn this off by setting the value to 0. To set the units for the interval, use LDAP Connection Heartbeat Time Unit.

Default: 10

Defines the search base for:

The keepalive and availability checks are only enabled if the heartbeat interval and timeout are set to a value greater than 0.

The LDAP server connection pool will be marked as unavailable if the search fails with an error, returns no entries, or if more than one entry is returned.

If the search results in an error, AM fails to start up with an exception such as org.forgerock.opendj.ldap.ConnectionException: Connect Error: No operational connection factories available.

Default: [Empty]

Defines the search filter for:

You can also use the absolute True and False filter (&).

The LDAP server connection pool will be marked as unavailable if the search fails with an error, returns no entries, or if more than one entry is returned.

If the search results in an error, AM fails to start up with an exception such as org.forgerock.opendj.ldap.ConnectionException: Connect Error: No operational connection factories available.

Default: (objectClass=*)

Time unit for the LDAP Connection Heartbeat Interval setting.

Default: second

A cap for the number of search results to return, for example, when viewing profiles under Identities. Rather than raise this number, consider narrowing your search to match fewer directory entries.

Default: 1000

Maximum time to wait for search results in seconds. Doesn’t apply to persistent searches.

Default: 10

LDAP searches can apply to a single entry (SCOPE_BASE), entries directly below the search DN (SCOPE_ONE), or all entries below the search DN (SEARCH_SUB).

Default: SCOPE_SUB

Enable this property to use Behera draft control in outgoing requests for operations that might modify password values.

Behera draft control allows AM to display password policy related error messages when password policies aren’t met.

Default: Enabled

Enables affinity-based load balanced access to identity stores.

Affinity-based load balancing means that each request for the same entry goes to the same directory server. The directory server used for a specific operation is determined by the DN of the identity involved.

List the directory server instances that form part of the affinity deployment in the LDAP Server field.

Set the operations that use affinity (none, bind only, or all operations) in the Affinity Level property.

Default: Disabled

The affinity level AM uses to balance requests across identity stores.

Default: ALL

Enables mutual TLS (mTLS) between AM and the directory server.

When mTLS is enabled, AM ignores the values for LDAP Bind DN and LDAP Bind Password.

If you enable this property, you must:

Default: Disabled

Identifier used to create a secret label for mapping to the mTLS certificate in the secret store. AM uses this identifier to create a specific secret label for this identity store. The secret label takes the form am.identity.repository.label.cert , where label is the value of mTLS Secret Label Identifier. The identifier can only contain alphanumeric characters (a-z, A-Z, 0-9) and periods (.). It can’t start or end with a period.

When you configure mTLS, you must map the secret label based on this identifier to the correct certificate alias. To avoid a temporarily "broken" mTLS connection, add the mTLS Secret Label Identifier first, without enabling mTLS. Then configure the mapping to the certificate alias, then enable mTLS.

For more security, you should rotate certificates periodically. When you rotate a certificate, update the corresponding mapping in the realm secret store configuration to reflect this identifier. When you rotate a certificate, AM closes any existing connections using the old certificate. AM selects a new connection from the connection pool and no server restart is required.

AM identity store implementation.

Default: org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo

Map of AM profile attribute names to directory server attribute names.

Specifies the identity types supported by the datastore, such as user, group, or realm, and which operations can be performed on them.

The following table illustrates the identity types supported by this datastore, and the operations that can be performed on them:

You can remove permissions based on your datastore needs. For example, if the datastore should not be written to, you can set the operations to read only for the identity types.

The service operation is only relevant to the realm and the user identity types. For example, the Session Service configuration can be stored by realm, and a user can have specific session timeout settings.

Default:
realm=read,create,edit,delete,service
user=read,create,edit,delete,service
group=read,create,edit,delete

When searching for a user by name, match values against this attribute.

Default: uid

When searching for users, apply this LDAP search filter as well.

Default: (objectclass=inetorgperson)

User profiles have these LDAP object classes.

AM handles only those attributes listed in this setting. AM discards any unlisted attributes from requests and the request proceeds without the attribute.

For example, with default settings, if you request that AM execute a search that asks for the mailAlternateAddress attribute, AM does the search, but doesn’t request mailAlternateAddress. In the same way, AM does perform an update operation with a request to set the value of an unlisted attribute like mailAlternateAddress, but it drops the unlisted attribute from the update request.

Default:
iplanet-am-managed-person
inetuser
sunFMSAML2NameIdentifier
inetorgperson
devicePrintProfilesContainer
pushDeviceProfilesContainer
iPlanetPreferences
iplanet-am-user-service
forgerock-am-dashboard-service
tyu
asd
organizationalperson
top
kbaInfoContainer
oathDeviceProfilesContainer
person
sunAMAuthAccountLockout
iplanet-am-auth-configuration-service

User profiles have these LDAP attributes.

AM handles only those attributes listed in this setting. AM discards any unlisted attributes from requests and the request proceeds without the attribute.

Default:
iplanet-am-user-password-reset-question-answer
mail
iplanet-am-user-alias-list
iplanet-am-auth-configuration
assignedDashboard
authorityRevocationList
dn
iplanet-am-user-password-reset-options
createTimestamp
employeeNumber
kbaActiveIndex
caCertificate
iplanet-am-session-quota-limit
iplanet-am-user-auth-config
sun-fm-saml2-nameid-infokey
sunIdentityMSISDNNumber
devicePrintProfiles
sunAMAuthInvalidAttemptsData
iplanet-am-user-password-reset-force-reset
givenName
iplanet-am-session-get-valid-sessions
objectClass
adminRole
inetUserHttpURL
iplanet-am-user-account-life
userCertificate
postalAddress
preferredtimezone
iplanet-am-user-admin-start-dn
oath2faEnabled
preferredlanguage
sun-fm-saml2-nameid-info
userPassword
iplanet-am-session-service-status
telephoneNumber
iplanet-am-session-max-idle-time
distinguishedName
iplanet-am-session-destroy-sessions
modifyTimestamp
uid
iplanet-am-user-success-url
kbaInfo
iplanet-am-user-auth-modules
sn
memberOf
preferredLocale
manager
iplanet-am-session-max-session-time
hhjghgh
cn
aaaa
oathDeviceProfiles
iplanet-am-user-login-status
pushDeviceProfiles
inetUserStatus
iplanet-am-user-failure-url
iplanet-am-session-max-caching-time

When creating a user profile, apply this map of AM profile attribute names to directory server attribute names.

Attributes not mapped to another attribute (for example, cn) and attributes mapped to themselves (for example, cn=cn) take the value of the username unless the attribute values are provided when creating the profile. The object classes for user profile LDAP entries generally require Common Name (cn) and Surname (sn) attributes, so this prevents an LDAP constraint violation when performing the add operation.

Default: cn, sn

Attribute to check/set user status.

Default: inetuserstatus

Active users have the user status attribute set to this value.

Default: Active

Inactive users have the user status attribute set to this value.

Default: Inactive

RDN attribute of the LDAP base DN which contains user profiles.

RDN attribute value of the LDAP base DN which contains user profiles.

If specified, AM will limit searches for user profiles to the provided base DN. Otherwise, AM searches the entire directory.

Profile attribute in which knowledge-based authentication information is stored.

Default: kbaInfo

Profile attribute in the which knowledge-based authentication index is stored.

Default: kbaActiveIndex

Profile attribute in which the number of failed attempts by a user when completing knowledge-based authentication information is stored.

Default: kbaInfoAttempts

RDN attribute for building the bind DN when given a username and password to authenticate a user against the directory server.

Default: uid

When searching for a group by name, match values against this attribute.

Default: cn

When searching for groups, apply this LDAP search filter as well.

Default: (objectclass=groupOfUniqueNames)

RDN attribute of the LDAP base DN which contains group profiles.

Default: ou

RDN attribute value of the LDAP base DN which contains group profiles.

If specified, AM will limit searches for group profiles to the provided base DN. Otherwise, AM searches the entire directory.

Default: groups

Group profiles have these LDAP object classes.

Default: groupofuniquenames, top

Group profiles have these LDAP attributes.

Default: dn, cn, uniqueMember, objectclass

LDAP attribute in the member’s LDAP entry whose values are the groups to which a member belongs.

Attribute in the group’s LDAP entry whose values are the members of the group.

Default: uniqueMember

Attribute in the dynamic group’s LDAP entry whose value is a URL specifying the members of the group.

Default: memberUrl

Base DN for LDAP-persistent searches used to receive notification of changes in directory server data.

Default: base-dn

LDAP filter to apply when performing persistent searches.

Default: (!(objectclass=frCoreToken))

LDAP searches can apply to a single entry (SCOPE_BASE), entries directly below the search DN (SCOPE_ONE), or all entries below the search DN (SEARCH_SUB).

Default: SCOPE_SUB

The number of milliseconds to wait between retry attempts when an LDAP operation fails with a retryable error.

Default: 1000

Whether to enable the DN cache, which is used to cache DN lookups that can happen in bursts during authentication. As the cache can become stale when a user is moved or renamed, enable DN caching when the directory service allows move/rename operations (Mod DN), and when AM uses persistent searches to obtain notification of such updates.

Default: true

Maximum number of DNs cached when caching is enabled.

Default: 1500