Advanced properties

The time period, in seconds, before the policy cache expires. During this period, all policy evaluation requests are read from the policy cache.

The maximum cache size for authorization policies.

The time period, in seconds, before the policy set cache expires. During this timeframe, all policy sets are read from the policy set cache.

The maximum cache size for authorization policy sets.

If true, the Certificate Collector node collects the entire chain of certificates from the request, and the Certificate Validation node validates all certificates in the chain. Otherwise, only the first certificate in the chain (the user certificate) is collected and validated.

By default, parallel updates can’t be made for CTS sessions. AM checks that the state of the CTS token in the CTS store is the same as the state previously read by the thread making the update. This prevents parallel replay attacks from circumventing authentication session allowlisting.

File that contains the path to the AM configuration folder. By default, the .openamcfg directory is created in the home directory of the user that runs the web container. For example, $HOME/.openamcfg/AMConfig_path_to_tomcat_webapps_am_.

Properly URL encode session tokens.

This property was used only for authentication with modules and chains and is no longer documented.

If true AM connects to the configuration directory server over LDAPS.

AM Configuration and log file location.

When using JSS or JSSE, check whether the name values in the SubjectAltName certificate match the server FQDN.

When using JSS or JSSE, check that the IP address of the server resolves to the host name.

When using JSS or JSSE, comma-separated list of server FQDNs to trust if they match the certificate CN, even if the domain name isn’t correct.

When using JSS or JSSE, set to true to trust whatever certificate is presented without checking.

Used with sticky load balancers that can inspect the cookie value.

Persistent cookie name.

Not used

Not used

Enables caching for configuration data and user data.

Time in minutes after which a web or Java agent’s server-side session expires. Note that this setting is ignored when AM creates a client-side session for a web or Java agent.

If true, client applications such as web or Java agents poll for server-side session changes. If false, client applications register listeners for notifications about changes to server-side sessions.

If client applications poll for changes, number of seconds between polls.

Create an HttpSession for users on successful authentication.

SSL socket factory implementation used by AM.

If true, AM checks for cookie support in the user agent and returns an error if cookies aren’t supported.

If true, AM appends the session cookie to the URL for a zero page session.

Cookie used by the AM authentication service to handle the authentication process.

Set the name of the HTTP header that AM can examine to learn the client IP address when requests go through a proxy or load balancer. (When requests go through an HTTP proxy or load balancer, checking the IP address on the request alone returns the address of the proxy or load balancer rather than that of the client.) AM must be able to trust the proxy or load balancer to set the client IP address correctly in the header specified.

If true, users can open many browser tabs to the login page at the same time without encountering an error.

If true, AM allows multiple cookie domains.

List of special users always authenticated against the local directory server.

Identifies an administrative user that replaces the amAdmin user. For example, uid=superroot,ou=people,dc=example,dc=com.

When cookie hijacking protection is configured, name of the cookie holding the URL to the AM server that authenticated the user.

Notification service endpoint for clients such as web and Java agents.

Number of threads in the shared system timer pool used to schedule operations such as session timeout.

When set to true, mark cookies as HTTPOnly to prevent scripts and third-party programs from accessing the cookies.

Configures support for applying SameSite cookie rules, as per internet-draft Cookies:HTTP State Management Mechanism.

If true, AM uses protection against cookie hijacking.

If false, JSS takes priority over other providers.

Activates AM monitoring.

URL for local connection to the monitoring service.

Internal property used by AM.

Weights of the cost of evaluating policy subjects, rules, and conditions. Evaluation is in order of the heaviest weight to the lightest.

Maximum number of policy decisions AM caches.

If true, AM performs a Java security permissions check.

Enables virtual hosts, partial hostname and IP address. Maps invalid or virtual name keys to valid FQDN values for proper redirection.

For additional compression of CTS token JSON binaries, beyond GZip, if desired.

For GZip-based compression of CTS tokens, if desired.

Enables tokens to be encrypted when stored.

Enables service configuration caching.

When service configuration caching time-to-live is enabled, this sets the time to live in minutes.

If service configuration caching is enabled, whether to enable a time-to-live for cached configuration.

File system directory to hold file-based representation of AM configuration.

Class used to read and write AM service configuration entries in the directory.

Used to set the read timeout in milliseconds for HTTP and HTTPS connections to other servers.

If true, AM sends an HTTP GET request to the com.sun.identity.urlchecker.targeturl as a health check against another server in the same site.

URL to monitor when com.sun.identity.urlchecker.dorequest is set to true.

If true, AM caches documents for HTTP and HTTPS connections to other servers.

Name of the web container to correctly set character encoding, if necessary.

Used to assign privileged console access to particular users. Set to a | separated list of users' Universal IDs, such as console.privileged.users=uid=bjensen,ou=user,dc=am,dc=example,dc=com|uid=scarter,ou=user,dc=am,dc=example,dc=com.

Forces AM to use the specification set in the Request Object Processing Specification field of the OAuth 2.0 provider configuration for JWT requests.

Where to destroy the old session after a session is successfully upgraded.

Class that controls which session properties are copied during session upgrade, where default is to copy all properties to the upgraded session.

The X-DSAMEVersion http header provides detailed information about the version of AM currently running on the system, including the build and date/time of the build. AM will need to be restarted once this property is enabled.

If true, AM ignores the goto query string parameter on logout and displays the logout page instead.

Character set used for globalization.

Comma-separated list of HTTP headers not to copy when the distributed authentication server forwards a request to another distributed authentication server.

Comma-separated list of HTTP headers not to copy when the distributed authentication server forwards a request to another distributed authentication server.

Comma-separated list of encryption algorithms that the OpenID Connect clients of the Social Identity Provider service can configure in the Private Key JWT Encryption Algorithm field.

Comma-separated list of HTTP headers to copy to the forwarded response when the server forwards a request to another server.

Comma-separated list of HTTP headers to copy to the forwarded request when the server forwards a request to another server.

If true, universal user IDs are considered case-sensitive when matching them.

Specifies whether AM can output logging at the Message level for the org.apache.http.wire and org.apache.http.headers logging appenders.

The class that implements the org.forgerock.openam.http.SslConnectionManager interface, which controls both keystore and truststore settings, as well as hostname verification.

A comma-separated list of audit events that won’t be logged.

This property was used only for authentication with modules and chains and is no longer documented.

When true, AM generates audit log messages for each authentication node reached during authentication tree flows.

When true, AM generates audit log messages with the outcome of authentication tree flows.

Specifies whether AM returns an HTTP 200 or HTTP 401 message when the user fails to complete the required actions to perform session upgrade during transactional authorization. Possible values are:

Days until account expiration set after successful authentication by the account expiration post-authentication plugin.

This property was used only for authentication with modules and chains and is no longer documented.

Specifies whether input forms and password fields can be autocompleted. This property only affects end-user pages in the classic UI. Possible values are true, to enable autocomplete, and false, to disable it.

Controls whether the results of resource file lookup should be cached.

Specifies whether the server should throw an exception, when it encounters an unknown attribute while parsing file-based configurations. By default, the server ignores any unknown attributes, and doesn’t throw an exception. To override this behavior, set this property to true.

For file-based configurations, enables property value substitution.

Enables access to the CTS REST endpoint /json/tokens.

Determines the digest algorithm used along with PBKDF2 key derivation method for AES Key Wrap encryption. Possible values are SHA1, SHA256, SHA384, or SHA512.

The number of iterations for the key derivation process specified in the org.forgerock.openam.encryption.key.digest advanced property.

The size of the derived key for the AES Key Wrap encryption operations.

Enables the algorithm to reduce the performance cost of AES Key Wrap encryption even when high-iteration counts are used. Possible values are true, to enable it, and false to disable it.

The time new client connections using the client handler will wait before timing out.

The maximum number of connections allowed in the pool available for clients using the client handler.

The maximum time-to-live, in milliseconds, for pooled client connections using the client handler.

The time a client using the client handler will wait for a response before timing out.

Specifies whether the client handler should retry failed connections. Possible values are true or false.

When true the client handler pools and reuses connections. Possible values are true or false.

Lists the target hosts for which requests shouldn’t be proxied. Use commas to separate hostnames.

When set to true, AM routes outgoing HttpClientHandler requests through the HTTP proxy defined on the JVM.

The password of the proxy that AM uses to route outgoing client handler requests.

The URI of the proxy that AM will use to route outgoing client handler requests. The URI must be in the format scheme://hostname:port. For example, https://myproxy.example.com:443.

The username of the proxy AM will use to route outgoing client handler requests.

Specifies whether the fields in JSON responses are always returned in lowercase. When true, AM converts the fields to lowercase.

Specifies whether AM allows HTTP GET requests, and the use of token as a query parameter in POST requests, on the oauth2/introspect endpoint.

Configures the client-side timeout, in milliseconds, applied to LDAP operations performed with the Netscape LDAP SDK.

Sets the DN cache timeout, in milliseconds, after which an entry should be removed from the cache. A value of 0 means that the DN cache won’t expire, and entries won’t be removed automatically.

The number of seconds AM should wait for a heartbeat operation to the DS server to complete, before considering the connection unavailable.

The protocols AM uses to connect to a secure LDAP server.

Controls whether to publish notifications for consumption by web agents and Java agents.

If set to true, a query to the /oauth2/idtokeninfo endpoint validates the iss (issuer) claim against the AM issuers. If the value of the iss claim differs from the AM issuer, AM returns the following error:

The period, in seconds, during which an OIDC ID token remains valid after its expiry time.

Lets you override the default maximum refresh token grace period.

By default, OIDC social authentication flows use the sub claim to identify the subject, in accordance with the OIDC specification, which mandates that the sub claim should uniquely identify the user.

Controls whether OpenID Connect clients can register dynamically without providing an access token.

Maximum number of RADIUS client sessions that can be cached concurrently on the AM server.

Specifies the maximum length of redirection URLs validated by AM. The Validation Service and other AM services perform redirection URL validation. Learn more in Configure trusted URLs.

RedirectUrlValidator.isRedirectUrlValid: The url was length 2015 which is longer than the allowed maximum of 2000

Specifies the maximum size of the body of any request made to AM. Learn more in Limit the size of the request body.

Specifies the name of the KeyStoreKeyIdProvider implementation AM uses to provide key ID (kids) to public keys when AM is configured as an OAuth 2.0 authorization server.

Specifies the fully qualified resource ID of the Google Cloud KMS secret used to decrypt secrets as they are read from the filesystem, environment variables, or system properties.

The format used to store the hash of the amAdmin user password.

The period, in seconds, after which the special administrator secret cache expires.

Sets the encryption method for client-side sessions. Possible values are:

The period (in seconds) after which the logout token cache purges expired entries. Changes to this property require a server restart.

Sets the padding mode for RSA encryption of client-side sessions. Possible values are:

Specifies whether signing client-side sessions is enabled. When true, AM allows selecting NONE as the signing algorithm for client-side sessions under Configure > Global Services > Session > Client-Side Sessions.

Specifies the amount of time, in milliseconds, that AM waits before considering that an outbound SMTP connection is unavailable.

Specifies the amount of time, in milliseconds, that AM waits for an SMTP read request to receive an acknowledgement before returning an error.

Specifies the amount of time, in milliseconds, that AM waits for an SMTP write request to receive an acknowledgement before returning an error.

Controls whether trace-level logging messages are generated when message-level debug logging is enabled in AM.

Specifies an ordered list of SSO providers. AM chooses the first applicable provider depending on the context for the requested SSO operation.

Specifies the maximum number of trees in a realm for which to cache the results of "state" scans.

Changes the UI’s behavior when an authenticated session expires. Possible values are false, where the user notices that their session has expired when trying to interact with the UI and they are redirected to the login screen, or true, where AM redirects the user to a page with the session expired message when their session expires. This prevents the display of possible sensitive information on the screen after a session expires.

Maximum size in entries of the OpenIdConnectSSOProvider provider’s cache. This cache is used to map OIDC tokens to SSO tokens for quick lookup.

Maintains a record of subject IDs matched or not matched in a given session. The cache is keyed on the token ID and the session is cleared when destroyed.

By default, calls to the subjectattributes endpoint are enforced per realm.

Specifies the format of the subject (sub) claim of an OAuth 2.0 access token, logout token, and OIDC ID token.

How often to poll the reaper cache for tokens that have expired, and delete them.

The number of records an AM instance will store in its CTS reaper cache.

Specifies a grace period used when searching for expired tokens. Any tokens that expired more than the specified duration ago are returned.

How often to perform a search for expired tokens in the CTS persistence store.

The maximum number of expired tokens to return to the AM reaper when searching the CTS store.

Specifies whether AM support for the DS entry expiration and deletion feature is enabled. Enabling this setting causes AM to clone the value of the coreTokenExpirationDate attribute to the coreTokenTtlDate attribute during token creation, which allows DS to index tokens using the coreTokenTtlDate attribute for the entry expiration and deletion feature.

Specifies whether the AM reaper is enabled.

When the org.forgerock.services.cts.store.ttlsupport.enabled advanced server property is set to true, this property specifies a list of token types which won’t have their coreTokenExpirationDate data cloned. For example, SESSION.

Timeout in seconds for LDAP connections to the configuration *.

Timeout in seconds for LDAP connections used for most CTS operations.

Timeout in seconds for the LDAP connection used for CTS token cleanup.

The maximum time, in seconds, that AM caches client-side session JWTs.

The size, in bytes, of the cache where AM stores client-side session JWTs.

Defines the search base for:

Defines the search filter for:

During authentication, AM records the type of user identified in an identity store. When this setting is enabled, AM uses these stored identities to decide which user to log in.

The node version is logged in the Authentication log under the AM-NODE-LOGIN-COMPLETED event. When this property is set to true, version is logged for all node versions.

Set this property to true to enable AI agents in AM.