Untitled | PingAM 8.0.1

Reference

This reference describes information useful for configuring PingAM tools, logs, deployment and services settings.

You can find reference information specific to authentication, such as node configuration, endpoints, and supported callbacks in Authentication reference.

PingAM provides two online API references for developers:

PingAM Public API Javadoc. Learn more in the PingAM Java API Specification
Common REST API. PingAM provides an online reference to the common REST API. Access the API on the AM admin UI by pointing to the following URL:
```
https://am.example.com:8443/am/ui-admin/#api/explorer
```

Standards support

View the wide range of standards that AM supports.

Command-line tools

Learn about the various AM command-line tools.

Global configuration reference

Review properties available when configuring AM at the global level.

Ports used

Ports that AM requires for operation.

Name changes for ForgeRock products

Product names changed when ForgeRock became part of Ping Identity.

The following name changes have been in effect since early 2024:

Old name	New name
ForgeRock Identity Cloud	PingOne Advanced Identity Cloud
ForgeRock Access Management	PingAM
ForgeRock Directory Services	PingDS
ForgeRock Identity Management	PingIDM
ForgeRock Identity Gateway	PingGateway

Old name

New name

ForgeRock Identity Cloud

PingOne Advanced Identity Cloud

ForgeRock Access Management

PingAM

ForgeRock Directory Services

PingDS

ForgeRock Identity Management

PingIDM

ForgeRock Identity Gateway

PingGateway

Learn more about the name changes in New names for ForgeRock products in the Knowledge Base.

Command line tools

This reference covers the PingAM command line tools.

ampassword

Change passwords for the AM Administrator.

ampassword { options }

Description

This command allows you to change passwords held in the configuration store, and to encrypt passwords.

Options

The following options are supported.

-a | --admin [ -o | --old old-password-file -n | --new new-password-file ]: Change the password for amAdmin from the value stored in old-password-file to the value stored in new-password-file.
-p | --proxy [ -o | --old old-password-file -n | --new new-password-file ]: Change the password for the proxy administrator from the value stored in old-password-file to the value stored in new-password-file.

The proxy administrator password is shown encrypted in the output from ssoadm get-svrcfg-xml.
-e | --encrypt [ password-file ]: Display the password value provided encrypted with the key generated during AM installation.
-h | --help: Display the usage message.

Examples

The following example encrypts the password contained within a text file.

Create a text file, for example $HOME/.pwd.txt, containing the password string on a single line.

Encrypt the password by using the ampassword command:

$ ampassword -e $HOME/.pwd.txt
AQICkZs3qy5QUCXir9tebIEEZYGFXI2lCC4B

bash

amverifyarchive

Check AM log archives for tampering.

amverifyarchive { options }

Description

This command checks log archive integrity.

Options

The following options are required.

-l logName: Verify log files of the specified type. To specify an individual log rather than a type, provide the entire log file name.
-p path: Path to log files to verify.
-u userName: User who can read log files.
-w password: Password of the user who can read log files.

Examples

The following example checks the amConsole logs:

$ amverifyarchive \
 -l amConsole \
 -p /path/to/am/var/audit/ \
 -u amadmin \
 -w password

bash

configurator.jar

Install or upgrade AM using a configuration file.

configurator.jar { options }

Description

This executable .jar file, openam-configurator-tool-14.1.3.29.jar, lets you perform silent installation, configuring a deployed AM server by applying settings from a configuration file.

Options

The following options are supported.

-f | --file configuration-file: Configure a deployed AM web application archive using the specified configuration file. Installation and upgrade configuration files are described in the sections below.
--acceptLicense: Auto-accept the software license agreement and suppress the display of the licence acceptance page to the user. If the configuration file contains the ACCEPT_LICENSES property, it will have precedence over the command-line option.
-? | --help: Display the usage message.

Installation configuration file

Base your configuration on the sampleconfiguration file delivered with AM, and using the hints in this section, or the comments included in the file.

Server Properties

These properties pertain to the AM server instance.

SERVER_URL: URL to the web container where you want AM to run, such as https://am.example.com:8443.
DEPLOYMENT_URI: URI where you want to deploy AM on the web container, such as /am.
BASE_DIR: Configuration directory where AM stores files, such as $HOME/am.
locale: The user locale, such as en_GB
PLATFORM_LOCALE: The locale of the AM server, such as en_US
AM_ENC_KEY: The password encryption key, which must be the same on all servers in a multiserver installation, such as O6QWwHPO4os+zEz3Nqn/2daAYWyiFE32. If left blank, installing AM generates a random password encryption key that you can view in the AM admin UI, under Deployment > Servers > Server Name > Security.
ADMIN_PWD: The password of the AM administrator user amAdmin, which must be at least 8 characters in length and must match that of other servers in a multiserver deployment.
COOKIE_DOMAIN: The name of the trusted DNS domain AM returns to a browser when it grants a session ID to a user. By default, it is set to the full URL used to access the configurator, such as example.com.
ACCEPT_LICENSES: Optional boolean property that can be set to always auto-accept the software license agreement and suppress the display of the license acceptance page to the user. A value of true auto-accepts the license; any other value will be assumed to equal false, resulting in the presentation of the license. Default value is false. This property takes precedence over the --acceptLicense option, which can also be passed in to the application with the openam-configurator-tool-14.1.3.29.jar file.

Configuration Store Properties

These properties pertain to the directory server where AM stores its configuration.

DATA_STORE: Set this to dirServer to indicate an external PingDS directory server. If the configuration store contains the configuration of other AM servers, then the server is added to the existing multiserver installation.

You must use an external directory server for the configuration store. If you try to install AM with the DATA_STORE=embedded property, the installation fails with the following exception From AM 8, embedded DS configuration is not supported.
DIRECTORY_SSL: Set this to SSL to use LDAP with SSL. DS is configured for LDAPS by default. To use LDAP without SSL, set this to SIMPLE.
DIRECTORY_SERVER: The fully qualified domain name of the configuration store directory server host, such as ds.example.com.
DIRECTORY_PORT: The LDAPS or LDAP port number for the configuration store directory server, such as 1636 or 1389.
DIRECTORY_ADMIN_PORT: The administration port number for the configuration store directory server, such as 4444.
ROOT_SUFFIX: The root suffix distinguished name (DN) for the configuration store, such as ou=am-config.
DS_DIRMGRDN: The bind DN of the configuration store user account, such as uid=am-config,ou=admins,ou=am-config.
DS_DIRMGRPASSWD: The password for the bind DN.

Identity Store Properties

These properties pertain to the directory server where AM stores identity profiles. If you don’t include these properties, or you leave these properties commented out, then AM uses the same directory server as it uses for the configuration store.

USERSTORE_TYPE

The type of directory server used for the identity store. Valid values include the following.

LDAPv3ForOpenDS: PingDS
LDAPv3ForAD: Active Directory with host and port settings
LDAPv3ForADDC: Active Directory with a Domain Name setting
LDAPv3ForADAM: Active Directory Lightweight Directory Services (Formerly known as Active Directory Application Mode (ADAM).)

USERSTORE_SSL

Set this to SSL to use LDAP with SSL. DS is configured for LDAPS by default. To use LDAP without SSL, set this to SIMPLE.

USERSTORE_DOMAINNAME

If USERSTORE_TYPE is LDAPv3ForADDC, you set this to the Active Directory Domain Name, such as ad.example.com, and then set only the USERSTORE_SSL, USERSTORE_MGRDN, and USERSTORE_PASSWD additional parameters. This lets Active Directory use DNS to retrieve service locations. Otherwise, don’t use this property.

USERSTORE_HOST

The fully qualified domain name of the identity store directory server, such as ds.example.com.

USERSTORE_PORT

The port number of the identity store. Default for LDAPS is 636 and for LDAP is 389.

USERSTORE_SUFFIX

The root suffix DN for the identity store, such as ou=identities.

USERSTORE_MGRDN

The bind DN of the identity store user account, such as uid=am-identity-bind-account,ou=admins,ou=identities.

USERSTORE_PASSWD

The password for the bind DN.

Site Properties

These properties pertain when you configure multiple AM servers in a site deployment, where a load balancer spreads request across multiple servers.

LB_SITE_NAME: The name of the AM site
LB_PRIMARY_URL: The load balancer URL for the site, such as https://lb.example.com:8443/am.

Upgrade Configuration File

Base your configuration on the sampleconfiguration file delivered with AM, and using the hints in this section, or the comments included in the file.

Upgrade Properties

SERVER_URL: URL to the web container where AM runs, such as https://am.example.com:8443
DEPLOYMENT_URI: URI where AM is deployed on the web container, such as /am
ACCEPT_LICENSES: Optional boolean property that can be set to always auto-accept the software license agreement and suppress displaying the license acceptance page to the user. A value of true auto-accepts the license; any other value will be assumed to equal false, resulting in the presentation of the license. Default value is false. This property takes precedence over the --acceptLicense option, which can also be passed in to the application with the openam-configurator-tool-14.1.3.29.jar file.

Examples

The following example shows a configuration file to install a server with separate configuration and identity datastores:

# Server properties, AM_ENC_KEY="" means generate random key
SERVER_URL=https://am.example.com:8443
DEPLOYMENT_URI=/am
BASE_DIR=$HOME/am
locale=en_US
PLATFORM_LOCALE=en_US
AM_ENC_KEY=
ADMIN_PWD=Ch4ng31t
COOKIE_DOMAIN=am.example.com
ACCEPT_LICENSES=true

# External configuration data store
DATA_STORE=dirServer
DIRECTORY_SSL=SSL
DIRECTORY_SERVER=ds.example.com
DIRECTORY_PORT=1636
DIRECTORY_ADMIN_PORT=4444
ROOT_SUFFIX=ou=am-config
DS_DIRMGRDN=uid=am-config,ou=admins,ou=am-config
DS_DIRMGRPASSWD=Ch4ng31t

# External DS-based user data store
USERSTORE_TYPE=LDAPv3ForOpenDS
USERSTORE_SSL=SSL
#USERSTORE_DOMAINNAME=ad.example.com
USERSTORE_HOST=ds.example.com
USERSTORE_PORT=1636
USERSTORE_SUFFIX=ou=identities
USERSTORE_MGRDN=uid=am-identity-bind-account,ou=admins,ou=identities
USERSTORE_PASSWD=Ch4ng31t

# Uncomment to specify the site for the first server in a site configuration
#LB_SITE_NAME=lb
#LB_PRIMARY_URL=http://lb.example.com:80/am

properties

The following example shows a configuration file to install the second server in a site configuration.

# Server properties, AM_ENC_KEY from first server
SERVER_URL=https://server2.example.com:8443
DEPLOYMENT_URI=/am
BASE_DIR=$HOME/am
locale=en_US
PLATFORM_LOCALE=en_US
AM_ENC_KEY=O6QWwHPO4os+zEz3Nqn/2daAYWyiFE32
ADMIN_PWD=Ch4ng31t
AMLDAPUSERPASSWD=Ch4ng31t
COOKIE_DOMAIN=am.example.com
ACCEPT_LICENSES=true

# External configuration data store
DATA_STORE=dirServer
DIRECTORY_SSL=SSL
DIRECTORY_SERVER=ds.example.com
DIRECTORY_PORT=1636
DIRECTORY_ADMIN_PORT=4444
ROOT_SUFFIX=ou=am-config
DS_DIRMGRDN=uid=am-config,ou=admins,ou=am-config
DS_DIRMGRPASSWD=Ch4ng31t

# External DS-based user data store
USERSTORE_TYPE=LDAPv3ForOpenDS
USERSTORE_SSL=SSL
#USERSTORE_DOMAINNAME=ad.example.com
USERSTORE_HOST=ds.example.com
USERSTORE_PORT=1636
USERSTORE_SUFFIX=ou=identities
USERSTORE_MGRDN=uid=am-identity-bind-account,ou=admins,ou=identities
USERSTORE_PASSWD=Ch4ng31t

# Site properties
LB_SITE_NAME=lb
LB_PRIMARY_URL=https://lb.example.com:8443/am

properties

The following example shows a configuration file to upgrade an AM server:

SERVER_URL=https://am.example.com:8443
DEPLOYMENT_URI=/am
ACCEPT_LICENSES=true

properties

The following example uses a configuration file with the --acceptLicense option on the command line.

$ java \
 -jar openam-configurator-tool-14.1.3.29.jar \
 -f config.file \
 --acceptLicense

bash

upgrade.jar

Upgrade AM using a configuration file.

upgrade.jar { options }

Description

This executable jar file, openam-upgrade-tool-14.1.3.29.jar, lets you perform a silent upgrade on a deployed AM server by applying settings from a configuration file or using arguments. This capability allows you to include the upgrade.jar from a command line or in an upgrade script.

Options

The following options are supported.

-f | --file configuration-file: Upgrade a deployed AM web application archive using the specified configuration file. Upgrade configuration files are described in the sections below. Also, you can specify the system properties on the command line, instead of using the configuration file.
--acceptLicense: Auto-accept the software license agreement and suppress the display of the licence acceptance page to the user. If the configuration file contains the ACCEPT_LICENSES property, it will have precedence over the command-line option.
-? | --help: Display the usage message.

Upgrade configuration file

Base your configuration on the sampleupgrade file delivered with AM, and using the hints in this section, or the comments included in the file.

Upgrade properties

SERVER_URL: URL to the web container where AM runs, such as https://am.example.com:8443.
DEPLOYMENT_URI: URI where AM is deployed on the web container, such as /am.
ACCEPT_LICENSES: Optional boolean property that can be set to always auto-accept the software license agreement and suppress displaying the license acceptance page to the user. A value of true auto-accepts the license; any other value will be assumed to equal false, resulting in the presentation of the license. Default value is false. This property takes precedence over the --acceptLicense option, which can also be passed in to the application with the openam-upgrade-tool-14.1.3.29.jar file.

Examples

The following example shows a configuration file and the commands to upgrade a server using the upgrade.jar. The configuration file is saved as /tmp/upgrade.txt.

SERVER_URL=https://am.example.com:8443
DEPLOYMENT_URI=/am
ACCEPT_LICENSES=true

properties

$JAVA_HOME/bin/java -jar ~/am/tools/openam-upgrade-tool-14.1.3.29.jar -f /tmp/upgrade.txt

bash

The following example shows how to specify system properties with the upgrade.jar.

SERVER_URL=https://am.example.com:8443
DEPLOYMENT_URI=/am
ACCEPT_LICENSES=true

properties

$JAVA_HOME/bin/java -jar ~/am/tools/openam-upgrade-tool-14.1.3.29.jar \
 -DSERVER_URL=https://am.example.com:8443 -DDEPLOYMENT_URI=/am

bash

The following example shows the use of the --acceptLicense option with the upgrade.jar.

SERVER_URL=https://am.example.com:8443
DEPLOYMENT_URI=/am

properties

$JAVA_HOME/bin/java -jar ~/am/tools/openam-upgrade-tool-14.1.3.29.jar \
 -DSERVER_URL=https://am.example.com:8443 -DDEPLOYMENT_URI=/am \
 --acceptLicense

bash

ssoadm

Configure OpenAM core services.

ssoadm [ subcommand ] [ options ]

Description

The ssoadm command provides a rich command-line interface for configuring OpenAM core services.

Also see Set up administration tools for instructions on setting up the ssoadm command.

Global options

The following global options are supported.

--debug, -d: Run in debug mode. Results sent to the debug file.
--help, -?: Print usage.

This command can also be used with subcommands as in ssoadm subcommand --help.
--information, -O: Print basic information about the tool.
--locale, -l: Name of the locale to display the results.
--verbose, -v: Run in verbose mode. Results sent to standard output.
--version, -V: Print the version of this tool.

JVM Properties for ssoadm

You can specifically set the authentication module or chain for administrator logins using two JVM settings. These settings provide more control to select the exact authentication mechanisms to be used when ssoadm authenticates administrators in the top-level realm.

To set these properties, manually edit the following two JVM settings in the ssoadm or ssoadm.bat script.

org.forgerock.openam.ssoadm.auth.indexType: Specifies the module or chain-based authentication in the top level realm. If the property is set, OpenAM uses only that authentication mechanism.
org.forgerock.openam.ssoadm.auth.indexName: Specifies the actual name of the authentication module/chain as controlled by the indexType setting. For example, if the indexType is set to module_instance and indexName is set to LDAP, then ssoadm authenticates using only the LDAP authentication module.

Subcommands by category

This section lists subcommands by category. The subsequent section lists subcommands in alphabetical order with a short description.

See ssoadm subcommand --help for detailed options.

Service Management

To translate settings applied in AM console to service attributes for use with ssoadm, login to the console as amadmin and access the services page, such as https://am.example.com:8443/am/services.jsp.

Subcommands: Alphabetical Order

The following subcommands are supported.

ssoadm add-agent-to-grp

Add agents to a agent group.

Usage: ssoadm add-agent-to-grp --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentgroupname, -b: Name of agent group.
--agentnames, -s: Names of agents.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm add-amsdk-idrepo-plugin

Create AMSDK IdRepo Plug-in

Usage: ssoadm add-amsdk-idrepo-plugin --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--basedn, -b: Directory Server base distinguished name.
--bind-password-file, -m: File that contains password of bind password.
--binddn, -e: Directory Server bind distinguished name.
--directory-servers, -s: directory servers <protocol>://<hostname>:<port>. Can have multiple entries.
--dsame-password-file, -x: File that contains password of the dsameuser
--password-file, -f: File name that contains password of administrator.
--puser-password-file, -p: File that contains password of the puser
[--org, -o]: Organization objects naming attribute (defaults to 'o')
[--user, -a]: User objects naming attribute (defaults to 'uid')

ssoadm add-app-priv

Add a policy set privilege to delegate resources of a given policy set. Note that policy sets are cached for 30 minutes. Restart OpenAM to apply changes immediately.

Usage: ssoadm add-app-priv --options [--global-options]

Options

--actions, -a: Possible values are READ, MODIFY, DELEGATE, ALL
--adminid, -u: Administrator ID of running the command.
--application, -t: Policy set name
--name, -m: Name for the this delegation
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
--subjects, -s: Subject name
--subjecttype, -b: Possible values are User or Group
[--description, -p]: Description for the this delegation.
[--resources, -r]: Resources to delegate, All resources in the policy set will be delegated if this option is absent.

ssoadm add-attr-defs

Add default attribute values in schema.

Usage: ssoadm add-attr-defs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.
[--subschemaname, -c]: Name of sub schema.

ssoadm add-attrs

Add attribute schema to an existing service.

Usage: ssoadm add-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschemafile, -F: XML file containing attribute schema definition.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Schema Type.
--servicename, -s: Service Name.
[--subschemaname, -c]: Name of sub schema.

ssoadm add-auth-cfg-entr

Add authentication configuration entry

Usage: ssoadm add-auth-cfg-entr --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--criteria, -c: Criteria for this entry. Possible values are REQUIRED, OPTIONAL, SUFFICIENT, REQUISITE
--modulename, -o: Module Name.
--name, -m: Name of authentication configuration.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--options, -t]: Options for this entry.
[--position, -p]: Position where the new entry is to be added. This is option is not set, entry shall be added to the end of the list. If value of this option is 0, it will be inserted to the front of the list. If value is greater of the length of the list, entry shall be added to the end of the list.

ssoadm add-cot-member

Add a member to a circle of trust.

Usage: ssoadm add-cot-member --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--cot, -t: Circle of Trust
--entityid, -y: Entity ID
--password-file, -f: File name that contains password of administrator.
[--realm, -e]: Realm where circle of trust resides
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm add-member

Add an identity as member of another identity

Usage: ssoadm add-member --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity
--memberidname, -m: Name of identity that is member.
--memberidtype, -y: Type of Identity of member such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm add-plugin-interface

Add Plug-in interface to service.

Usage: ssoadm add-plugin-interface --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--i18nkey, -k: Plug-in I18n Key.
--interfacename, -i: Name of interface.
--password-file, -f: File name that contains password of administrator.
--pluginname, -g: Name of Plug-in.
--servicename, -s: Name of service.

ssoadm add-plugin-schema

Add Plug-in schema to service.

Usage: ssoadm add-plugin-schema --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--classname, -c: Name of the Plugin Schema class implementation
--i18nkey, -k: Plug-in I18n Key.
--i18nname, -n: Plug-in I18n Name.
--interfacename, -i: Name of interface.
--password-file, -f: File name that contains password of administrator.
--pluginname, -g: Name of Plug-in.
--servicename, -s: Name of service.

ssoadm add-privileges

Add privileges to an identity. To add a privilege to all authenticated users, use the "All Authenticated Users" idname with "role" idtype.

Usage: ssoadm add-privileges --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as Role and Group.
--password-file, -f: File name that contains password of administrator.
--privileges, -g: Name of privileges to be added. Privilege names are AgentAdmin, ApplicationModifyAccess, ApplicationReadAccess, ApplicationTypesReadAccess, ConditionTypesReadAccess, DecisionCombinersReadAccess, EntitlementRestAccess, FederationAdmin, LogAdmin, LogRead, LogWrite, PolicyAdmin, PrivilegeRestAccess, PrivilegeRestReadAccess, RealmAdmin, RealmReadAccess, ResourceTypeModifyAccess, ResourceTypeReadAccess, SubjectAttributesReadAccess, and SubjectTypesReadAccess.
--realm, -e: Name of realm.

ssoadm add-res-bundle

Add resource bundle to data store.

Usage: ssoadm add-res-bundle --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--bundlefilename, -B: Resource bundle physical file name.
--bundlename, -b: Resource Bundle Name.
--password-file, -f: File name that contains password of administrator.
[--bundlelocale, -o]: Locale of the resource bundle.

ssoadm add-site-members

Add members to a site.

Usage: ssoadm add-site-members --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servernames, -e: Server names, such as http://www.example.com:8080/fam
--sitename, -s: Site name, e.g. mysite

ssoadm add-site-sec-urls

Add Site Secondary URLs.

Usage: ssoadm add-site-sec-urls --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--secondaryurls, -a: Secondary URLs
--sitename, -s: Site name, e.g. mysite

ssoadm add-sub-schema

Add sub schema.

Usage: ssoadm add-sub-schema --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--filename, -F: Name of file that contains the schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.

ssoadm add-svc-attrs

Add service attribute values in a realm. Long content for an attribute can be supplied in a file by appending '-file' to the attribute name, and giving the filename as the value.

Usage: ssoadm add-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values to be added e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values to be added.

ssoadm add-svc-identity

Add Service to an identity

Usage: ssoadm add-svc-identity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm add-svc-realm

Add service to a realm. Long content for an attribute can be supplied in a file by appending '-file' to the attribute name, and giving the filename as the value.

Usage: ssoadm add-svc-realm --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Service Name.
[--attributevalues, -a]: Attribute values e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm agent-remove-props

Remove agent’s properties.

Usage: ssoadm agent-remove-props --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentname, -b: Name of agent.
--attributenames, -a: properties name(s).
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm clone-server

Clone a server instance.

Usage: ssoadm clone-server --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--cloneservername, -o: Clone server name
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name

ssoadm create-agent

Create a new agent configuration.

Usage: ssoadm create-agent --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentname, -b: Name of agent.
--agenttype, -t: Type of agent. Possible values: J2EEAgent, WebAgent, 2.2_Agent, SharedAgent, OAuth2Client
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--agenturl, -g]: Agent URL. such as http://www.agent.example:8080/agent\. WebAgent does not take URL with path, such as http://www.agent.example:8080. This option is valid only for J2EEAgent and WebAgent agent types, and is required when the agent type is J2EEAgent or WebAgent.
[--attributevalues, -a]: Properties, such as sunIdentityServerDeviceKeyValue=https://agent.example.com:443/
[--datafile, -D]: Name of file that contains properties.
[--serverurl, -s]: Server URL. such as http://www.example.com:58080/openam. This option is valid only for J2EEAgent and WebAgent agent types, and is required when the agent type is J2EEAgent or WebAgent.

ssoadm create-agent-grp

Create a new agent group.

Usage: ssoadm create-agent-grp --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentgroupname, -b: Name of agent group.
--agenttype, -t: Type of agent group. e.g. J2EEAgent, WebAgent
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Properties e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains properties.
[--serverurl, -s]: Server URL. such as http://www.example.com:58080/openam. This option is valid for J2EEAgent and WebAgent.

ssoadm create-appl

Create policy set.

Usage: ssoadm create-appl --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--applicationtype, -t: Application type name
--name, -m: Policy set name
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
[--attributevalues, -a]: Attribute values e.g. applicationType=iPlanetAMWebAgentService.
[--datafile, -D]: Name of file that contains attribute values data. Mandatory attributes are resources, subjects, conditions and entitlementCombiner. Optional ones are actions, searchIndexImpl, saveIndexImpl, resourceComparator, subjectAttributeNames.

ssoadm create-appl-type

Create application type.

Usage: ssoadm create-appl-type --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Application Type name
--password-file, -f: File name that contains password of administrator.
[--attributevalues, -a]: Application Type attribute values e.g. actions=enabled=true.
[--datafile, -D]: Name of file that contains attribute type values data. Mandatory attributes are actions, searchIndexImpl and saveIndexImpl. Optional are resourceComparator.

ssoadm create-auth-cfg

Create authentication configuration

Usage: ssoadm create-auth-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of authentication configuration.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm create-auth-instance

Create authentication module instance

Usage: ssoadm create-auth-instance --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--authtype, -t: Type of authentication module instance. Possible values include AD, Adaptive, Anonymous, Cert, DataStore, DeviceIdMatch, DeviceIdSave, Federation, HOTP, HTTPBasic, JDBC, LDAP, Membership, MSISDN, OATH, OAuth, OpenIdConnect, PersistentCookie, RADIUS, SAE, Scripted, WindowsDesktopSSO, NT, and WSSAuthModule.
--name, -m: Name of authentication module instance.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm create-cot

Create circle of trust.

Usage: ssoadm create-cot --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--cot, -t: Circle of Trust
--password-file, -f: File name that contains password of administrator.
[--prefix, -p]: Prefix URL for idp discovery reader and writer URL.
[--realm, -e]: Realm where circle of trust resides
[--trustedproviders, -k]: Trusted Providers

ssoadm create-datastore

Create data store under a realm

Usage: ssoadm create-datastore --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--datatype, -t: Type of datastore. Use the list-datastore-types subcommand to get a list of supported datastore types.
--name, -m: Name of datastore.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Attribute values e.g. sunIdRepoClass=com.sun.identity.idm.plugins.files.FilesRepo.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm create-identity

Create identity in a realm

Usage: ssoadm create-identity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Attribute values e.g. sunIdentityServerDeviceStatus=Active.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm create-metadata-templ

Create new metadata template.

Usage: ssoadm create-metadata-templ --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--entityid, -y: Entity ID
--password-file, -f: File name that contains password of administrator.
[--affiecertalias, -K]: Affiliation encryption certificate alias
[--affiliation, -F]: Specify metaAlias for hosted affiliation. to be created. The format must be <realm name>/<identifier>.
[--affimembers, -M]: Affiliation members
[--affiownerid, -N]: Affiliation Owner ID
[--affiscertalias, -J]: Affiliation signing certificate alias
[--attraecertalias, -G]: Attribute authority encryption certificate alias.
[--attrascertalias, -B]: Attribute authority signing certificate alias
[--attrauthority, -I]: Specify metaAlias for hosted attribute authority to be created. The format must be <realm name>/<identifier>.
[--attrqecertalias, -R]: Attribute query provider encryption certificate alias
[--attrqscertalias, -A]: Attribute query provider signing certificate alias
[--attrqueryprovider, -S]: Specify metaAlias for hosted attribute query provider to be created. The format must be <realm name>/<identifier>.
[--authnaecertalias, -E]: Authentication authority encryption certificate alias.
[--authnascertalias, -D]: Authentication authority signing certificate alias
[--authnauthority, -C]: Specify metaAlias for hosted authentication authority to be created. The format must be <realm name>/<identifier>.
[--extended-data-file, -x]: Specify file name for the extended metadata to be created. XML will be displayed on terminal if this file name is not provided.
[--identityprovider, -i]: Specify metaAlias for hosted identity provider to be created. The format must be <realm name>/<identifier>.
[--idpecertalias, -g]: Identity provider encryption certificate alias.
[--idpscertalias, -b]: Identity provider signing certificate alias
[--meta-data-file, -m]: Specify file name for the standard metadata to be created. XML will be displayed on terminal if this file name is not provided.
[--serviceprovider, -s]: Specify metaAlias for hosted service provider to be created. The format must be <realm name>/<identifier>.
[--specertalias, -r]: Service provider encryption certificate alias
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2
[--spscertalias, -a]: Service provider signing certificate alias
[--xacmlpdpecertalias, -j]: Policy decision point encryption certificate alias
[--xacmlpdpscertalias, -t]: Policy decision point signing certificate alias
[--xacmlpdp, -p]: Specify metaAlias for policy decision point to be created. The format must be <realm name>/<identifier>.
[--xacmlpepecertalias, -z]: Policy enforcement point encryption certificate alias
[--xacmlpepscertalias, -k]: Policy enforcement point signing certificate alias
[--xacmlpep, -e]: Specify metaAlias for policy enforcement point to be created. The format must be <realm name>/<identifier>.

ssoadm create-realm

Create realm.

Usage: ssoadm create-realm --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm to be created.

ssoadm create-server

Create a server instance.

Usage: ssoadm create-server --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--serverconfigxml, -X: Server Configuration XML file name.
--servername, -s: Server name, such as http://www.example.com:8080/fam
[--attributevalues, -a]: Attribute values e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm create-site

Create a site.

Usage: ssoadm create-site --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--sitename, -s: Site name, e.g. mysite
--siteurl, -i: Site’s primary URL, such as http://www.example.com:8080
[--secondaryurls, -a]: Secondary URLs

ssoadm create-sub-cfg

Create a new sub configuration. Long content for an attribute can be supplied in a file by appending '-file' to the attribute name, and giving the filename as the value.

Usage: ssoadm create-sub-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.
--subconfigname, -g: Sub-schema name of (or path to) the type of sub-configuration being added.
[--attributevalues, -a]: Attribute values e.g. homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.
[--priority, -p]: Priority of the sub configuration.
[--realm, -e]: Name of realm (Sub Configuration shall be added to global configuration if this option is not provided).
[--subconfigid, -b]: User-specfieid ID of (or path to) the sub-configuration.

ssoadm create-svc

Create a new service in server.

Usage: ssoadm create-svc --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--xmlfile, -X: XML file(s) that contains schema.
[--continue, -c]: Continue adding service if one or more previous service cannot be added.

ssoadm create-svrcfg-xml

Create serverconfig.xml file. No options are required for flat file configuration data store.

Usage: ssoadm create-svrcfg-xml --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
[--basedn, -b]: Directory Server base distinguished name.
[--dsadmin, -a]: Directory Server administrator distinguished name
[--dshost, -t]: Directory Server host name
[--dspassword-file, -x]: File that contains Directory Server administrator password
[--dsport, -p]: Directory Server port number
[--outfile, -o]: File name where serverconfig XML is written.

ssoadm create-xacml

Create policies in a realm with XACML input.

Usage: ssoadm create-xacml --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--xmlfile, -X: File that contains the policy XACML definition. In the console, paste the XML into the text field instead.
[--dryrun, -n]: Provide a summary of the policies which would be updated, and those which would be added, as a result of the create-xacml command without the 'dryrun' option specified. Nothing will be updated or added when using this option.
[--outfile, -o]: Filename where the output of a 'dryrun' command will be sent to. If no 'dryrun' command is specified, the outfile will not be used for anything.

ssoadm delete-agent-grps

Delete agent groups.

Usage: ssoadm delete-agent-grps --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--agentgroupnames, -s]: Separate multiple agent group names with spaces.
[--file, -D]: File containing agent group names, with multiple group names separated by spaces.

ssoadm delete-agents

Delete agent configurations.

Usage: ssoadm delete-agents --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--agentnames, -s]: Separate multiple agent names with spaces.
[--file, -D]: File containing agent names, with multiple agent names separated by spaces.

ssoadm delete-appl-types

Delete application types.

Usage: ssoadm delete-appl-types --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--names, -m: Application Type names
--password-file, -f: File name that contains password of administrator.

ssoadm delete-appls

Delete policy sets. Note that policy sets are cached for 30 minutes. Restart OpenAM to apply changes immediately.

Usage: ssoadm delete-appls --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--names, -m: Policy set names
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name

ssoadm delete-attr

Delete attribute schemas from a service

Usage: ssoadm delete-attr --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema to be removed.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm delete-attr-def-values

Delete attribute schema default values.

Usage: ssoadm delete-attr-def-values --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--defaultvalues, -e: Default value(s) to be deleted
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm delete-auth-cfgs

Delete authentication configurations

Usage: ssoadm delete-auth-cfgs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--names, -m: Name of authentication configurations.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm delete-auth-instances

Delete authentication instances

Usage: ssoadm delete-auth-instances --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--names, -m: Name of authentication instances.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm delete-cot

Delete circle of trust.

Usage: ssoadm delete-cot --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--cot, -t: Circle of Trust
--password-file, -f: File name that contains password of administrator.
[--realm, -e]: Realm where circle of trust resides

ssoadm delete-datastores

Delete data stores under a realm

Usage: ssoadm delete-datastores --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--names, -m: Names of datastore.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm delete-entity

Delete entity.

Usage: ssoadm delete-entity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--entityid, -y: Entity ID
--password-file, -f: File name that contains password of administrator.
[--extendedonly, -x]: Set to flag to delete only extended data.
[--realm, -e]: Realm where data resides
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm delete-identities

Delete identities in a realm

Usage: ssoadm delete-identities --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--file, -D]: Name of file that contains the identity names to be deleted.
[--idnames, -i]: Names of identites.

ssoadm delete-realm

Delete realm.

Usage: ssoadm delete-realm --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm to be deleted.
[--recursive, -r]: Delete descendent realms recursively.

ssoadm delete-realm-attr

Delete attribute from a realm.

Usage: ssoadm delete-realm-attr --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributename, -a: Name of attribute to be removed.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.

ssoadm delete-server

Delete a server instance.

Usage: ssoadm delete-server --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as http://www.example.com:8080/fam

ssoadm delete-site

Delete a site.

Usage: ssoadm delete-site --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--sitename, -s: Site name, e.g. mysite

ssoadm delete-sub-cfg

Remove Sub Configuration.

Usage: ssoadm delete-sub-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.
--subconfigname, -g: Name of sub configuration.
[--realm, -e]: Name of realm (Sub Configuration shall be deleted from the global configuration if this option is not provided).

ssoadm delete-svc

Delete service from the server.

Usage: ssoadm delete-svc --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Service Name(s).
[--continue, -c]: Continue deleting service if one or more previous services cannot be deleted.
[--deletepolicyrule, -r]: Delete policy rule.

ssoadm delete-xacml

Delete XACML policies from a realm.

Usage: ssoadm delete-xacml --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--file, -D]: Name of file that contains the policy names to be deleted.
[--policynames, -p]: Names of policy to be deleted.

ssoadm do-batch

Do multiple requests in one command.

Usage: ssoadm do-batch --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--batchfile, -Z: Name of file that contains commands and options.
--password-file, -f: File name that contains password of administrator.
[--batchstatus, -b]: Name of status file.
[--continue, -c]: Continue processing the rest of the request when preceeding request was erroneous.

ssoadm do-bulk-federation

Perform bulk federation.

Usage: ssoadm do-bulk-federation --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--metaalias, -m: Specify metaAlias for local provider.
--nameidmapping, -e: Name of file that will be created by this sub command. It contains remote user Id to name identifier. It shall be used by remote provider to update user profile.
--password-file, -f: File name that contains password of administrator.
--remoteentityid, -r: Remote entity Id
--useridmapping, -g: File name of local to remote user Id mapping. Format <local-user-id>|<remote-user-id>.
[--spec, -c]: Specify metadata specification, either idff or saml2, defaults to saml2

ssoadm do-migration70

Migrate organization to realm.

Usage: ssoadm do-migration70 --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--entrydn, -e: Distinguished name of organization to be migrated.
--password-file, -f: File name that contains password of administrator.

ssoadm export-entity

Export entity.

Usage: ssoadm export-entity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--entityid, -y: Entity ID
--password-file, -f: File name that contains password of administrator.
[--extended-data-file, -x]: Extended data
[--meta-data-file, -m]: Metadata
[--realm, -e]: Realm where data resides
[--sign, -g]: Set this flag to sign the metadata
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm export-server

Export a server instance.

Usage: ssoadm export-server --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name
[--outfile, -o]: Filename where configuration was written.

ssoadm export-svc-cfg

Export service configuration. In production environments, you should back up the service configuration using file system utilities or the export-ldif command. Note that export-ldif/import-ldif commands must be on the same deployment where the encryption keys are located.

Usage: ssoadm export-svc-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--encryptsecret, -e: Secret key for encrypting password. Any arbitrary value can be specified.
--password-file, -f: File name that contains password of administrator.
[--outfile, -o]: Filename where configuration was written.

ssoadm get-attr-choicevals

Get choice values of attribute schema.

Usage: ssoadm get-attr-choicevals --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributename, -a: Name of attribute.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm get-attr-defs

Get default attribute values in schema.

Usage: ssoadm get-attr-defs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema. One of dynamic, global, or organization (meaning realm).
--servicename, -s: Name of service.
[--attributenames, -a]: Attribute name(s).
[--subschemaname, -c]: Name of sub schema.

ssoadm get-auth-cfg-entr

Get authentication configuration entries

Usage: ssoadm get-auth-cfg-entr --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of authentication configuration.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm get-auth-instance

Get authentication instance values

Usage: ssoadm get-auth-instance --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of authentication instance.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm get-identity

Get identity property values

Usage: ssoadm get-identity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributenames, -a]: Attribute name(s). All attribute values shall be returned if the option is not provided.

ssoadm get-identity-svcs

Get the service in an identity

Usage: ssoadm get-identity-svcs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm get-realm

Get realm property values.

Usage: ssoadm get-realm --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.

ssoadm get-realm-svc-attrs

Get realm’s service attribute values.

Usage: ssoadm get-realm-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.

ssoadm get-recording-status

Get the status of recording operations.

Usage: ssoadm get-recording-status --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as https://am.example.com:8443/am\

ssoadm get-revision-number

Get service schema revision number.

Usage: ssoadm get-revision-number --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.

ssoadm get-sub-cfg

Get sub configuration.

Usage: ssoadm get-sub-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.
--subconfigname, -g: Name of sub configuration.
[--realm, -e]: Name of realm (Sub Configuration shall be retrieved from the global configuration if this option is not provided).

ssoadm get-svrcfg-xml

Get server configuration XML from centralized data store

Usage: ssoadm get-svrcfg-xml --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as http://www.example.com:8080/fam
[--outfile, -o]: File name where serverconfig XML is written.

ssoadm import-bulk-fed-data

Import bulk federation data which is generated by 'do-bulk-federation' sub command.

Usage: ssoadm import-bulk-fed-data --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--bulk-data-file, -g: File name of bulk federation data which is generated by 'do-bulk-federation' sub command.
--metaalias, -m: Specify metaAlias for local provider.
--password-file, -f: File name that contains password of administrator.
[--spec, -c]: Specify metadata specification, either idff or saml2, defaults to saml2

ssoadm import-entity

Import entity.

Usage: ssoadm import-entity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
[--cot, -t]: Specify name of the Circle of Trust this entity belongs.
[--extended-data-file, -x]: Specify file name for the extended entity configuration to be imported. Extended entity configuration to be imported.
[--meta-data-file, -m]: Specify file name for the standard metadata to be imported.<web>Standard metadata to be imported.
[--realm, -e]: Realm where entity resides.
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm import-server

Import a server instance.

Usage: ssoadm import-server --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name
--xmlfile, -X: XML file that contains configuration.

ssoadm import-svc-cfg

Import service configuration. In production environments, you should restore the service configuration using file system utilities or the import-ldif command. Note that import-ldif/export-ldif commands must be on the same deployment where the encryption keys are located.

Usage: ssoadm import-svc-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--encryptsecret, -e: Secret key for decrypting password.
--password-file, -f: File name that contains password of administrator.
--xmlfile, -X: XML file that contains configuration data.

ssoadm list-agent-grp-members

List agents in agent group.

Usage: ssoadm list-agent-grp-members --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentgroupname, -b: Name of agent group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--filter, -x]: Filter (Pattern).

ssoadm list-agent-grps

List agent groups.

Usage: ssoadm list-agent-grps --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--agenttype, -t]: Type of agent. e.g. J2EEAgent, WebAgent
[--filter, -x]: Filter (Pattern).

ssoadm list-agents

List agent configurations.

Usage: ssoadm list-agents --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--agenttype, -t]: Type of agent. e.g. J2EEAgent, WebAgent
[--filter, -x]: Filter (Pattern).

ssoadm list-app-privs

List policy set privileges in a realm.

Usage: ssoadm list-app-privs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name

ssoadm list-appl-types

List application types.

Usage: ssoadm list-appl-types --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm list-appls

List policy set in a realm.

Usage: ssoadm list-appls --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name

ssoadm list-auth-cfgs

List authentication configurations

Usage: ssoadm list-auth-cfgs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm list-auth-instances

List authentication instances

Usage: ssoadm list-auth-instances --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm list-cot-members

List the members in a circle of trust.

Usage: ssoadm list-cot-members --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--cot, -t: Circle of Trust
--password-file, -f: File name that contains password of administrator.
[--realm, -e]: Realm where circle of trust resides
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm list-cots

List circles of trust.

Usage: ssoadm list-cots --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
[--realm, -e]: Realm where circle of trusts reside

ssoadm list-datastore-types

List the supported data store types

Usage: ssoadm list-datastore-types --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm list-datastores

List data stores under a realm

Usage: ssoadm list-datastores --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm list-entities

List entities under a realm.

Usage: ssoadm list-entities --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
[--realm, -e]: Realm where entities reside.
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm list-identities

List identities in a realm

Usage: ssoadm list-identities --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--filter, -x: Filter (Pattern).
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm list-identity-assignable-svcs

List the assignable service to an identity

Usage: ssoadm list-identity-assignable-svcs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm list-realm-assignable-svcs

List the assignable services to a realm.

Usage: ssoadm list-realm-assignable-svcs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm list-realms

List realms by name.

Usage: ssoadm list-realms --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm where search begins.
[--filter, -x]: Filter (Pattern).
[--recursive, -r]: Search recursively

ssoadm list-res-bundle

List resource bundle in data store.

Usage: ssoadm list-res-bundle --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--bundlename, -b: Resource Bundle Name.
--password-file, -f: File name that contains password of administrator.
[--bundlelocale, -o]: Locale of the resource bundle.

ssoadm list-server-cfg

List server configuration.

Usage: ssoadm list-server-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as http://www.example.com:8080/fam or enter default to list default server configuration.
[--withdefaults, -w]: Set this flag to get default configuration.

ssoadm list-servers

List all server instances.

Usage: ssoadm list-servers --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm list-sessions

List server-side sessions.

Usage: ssoadm list-sessions --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--host, -t: Host Name.
--password-file, -f: File name that contains password of administrator.
[--filter, -x]: Filter (Pattern).
[--quiet, -q]: Do not prompt for session invalidation.

ssoadm list-sites

List all sites.

Usage: ssoadm list-sites --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm list-xacml

Export policies in realm as XACML.

Usage: ssoadm list-xacml --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--namesonly, -n]: Returns only names of matching policies. Policies are not returned.
[--outfile, -o]: Filename where policy definition will be printed to. Definition will be printed in standard output if this option is not provided.
[--policynames, -p]: Names of policy. This can be a wildcard. All policy definition in the realm will be returned if this option is not provided.

ssoadm policy-export

Export policy configuration for a given realm

Usage: ssoadm policy-export --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--jsonfile, -J: JSON file for which to write the policy model to.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
--servername, -s: Server name, such as https://am.example.com:8443/am

ssoadm policy-import

Import policy model into a given realm

Usage: ssoadm policy-import --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--jsonfile, -J: JSON file containing the policy model to be imported.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
--servername, -s: Server name, such as https://am.example.com:8443/am

ssoadm register-auth-module

Registers authentication module.

Usage: ssoadm register-auth-module --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--authmodule, -a: Java class name of authentication module.
--password-file, -f: File name that contains password of administrator.

ssoadm remove-agent-from-grp

Remove agents from a agent group.

Usage: ssoadm remove-agent-from-grp --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentgroupname, -b: Name of agent group.
--agentnames, -s: Names of agents.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm remove-app-priv-resources

Remove policy set privilege resources. Note that policy sets are cached for 30 minutes. Restart OpenAM to apply changes immediately.

Usage: ssoadm remove-app-priv-resources --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--application, -t: Policy set name
--name, -m: Name for the this delegation
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
[--resources, -r]: Resources to removed. All resources in the policy set will be removed if this option is absent.

ssoadm remove-app-priv-subjects

Remove policy set privilege subjects.

Usage: ssoadm remove-app-priv-subjects --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name for the this delegation
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
--subjects, -s: Subject name
--subjecttype, -b: Possible values are User or Group

ssoadm remove-app-privs

Remove policy set privileges.

Usage: ssoadm remove-app-privs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--names, -m: Names of policy set privileges to be removed
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name

ssoadm remove-attr-choicevals

Remove choice values from attribute schema.

Usage: ssoadm remove-attr-choicevals --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributename, -a: Name of attribute.
--choicevalues, -k: Choice values such as Inactive
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm remove-attr-defs

Remove default attribute values in schema.

Usage: ssoadm remove-attr-defs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributenames, -a: Attribute name(s).
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm remove-cot-member

Remove a member from a circle of trust.

Usage: ssoadm remove-cot-member --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--cot, -t: Circle of Trust
--entityid, -y: Entity ID
--password-file, -f: File name that contains password of administrator.
[--realm, -e]: Realm where circle of trust resides
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2

ssoadm remove-member

Remove membership of identity from another identity

Usage: ssoadm remove-member --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity
--memberidname, -m: Name of identity that is member.
--memberidtype, -y: Type of Identity of member such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm remove-plugin-schema

Add Plug-in interface to service.

Usage: ssoadm remove-plugin-schema --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--interfacename, -i: Name of interface.
--password-file, -f: File name that contains password of administrator.
--pluginname, -g: Name of Plug-in.
--servicename, -s: Name of service.

ssoadm remove-privileges

Remove privileges from an identity

Usage: ssoadm remove-privileges --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as Role and Group.
--password-file, -f: File name that contains password of administrator.
--privileges, -g: Name of privileges to be removed. Privilege names are AgentAdmin, ApplicationModifyAccess, ApplicationReadAccess, ApplicationTypesReadAccess, ConditionTypesReadAccess, DecisionCombinersReadAccess, EntitlementRestAccess, FederationAdmin, LogAdmin, LogRead, LogWrite, PolicyAdmin, PrivilegeRestAccess, PrivilegeRestReadAccess, RealmAdmin, RealmReadAccess, ResourceTypeModifyAccess, ResourceTypeReadAccess, SubjectAttributesReadAccess, and SubjectTypesReadAccess.
--realm, -e: Name of realm.

ssoadm remove-res-bundle

Remove resource bundle from data store.

Usage: ssoadm remove-res-bundle --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--bundlename, -b: Resource Bundle Name.
--password-file, -f: File name that contains password of administrator.
[--bundlelocale, -o]: Locale of the resource bundle.

ssoadm remove-server-cfg

Remove server configuration.

Usage: ssoadm remove-server-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--propertynames, -a: Name of properties to be removed.
--servername, -s: Server name, such as http://www.example.com:8080/fam or enter default to remove default server configuration.

ssoadm remove-site-members

Remove members from a site.

Usage: ssoadm remove-site-members --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servernames, -e: Server names, such as http://www.example.com:8080/fam
--sitename, -s: Site name, such as mysite

ssoadm remove-site-sec-urls

Remove Site Secondary URLs.

Usage: ssoadm remove-site-sec-urls --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--secondaryurls, -a: Secondary URLs
--sitename, -s: Site name, such as mysite

ssoadm remove-sub-schema

Remove sub schema.

Usage: ssoadm remove-sub-schema --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--subschemanames, -a: Name(s) of sub schema to be removed.
[--subschemaname, -c]: Name of parent sub schema.

ssoadm remove-svc-attrs

Remove service attribute values in a realm.

Usage: ssoadm remove-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values to be removed such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values to be removed.

ssoadm remove-svc-identity

Remove Service from an identity

Usage: ssoadm remove-svc-identity --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.

ssoadm remove-svc-realm

Remove service from a realm.

Usage: ssoadm remove-svc-realm --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service to be removed.

ssoadm set-appl

Set policy set attributes. Note that policy sets are cached for 30 minutes. Restart OpenAM to apply changes immediately.

Usage: ssoadm set-appl --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Policy set name
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
[--attributevalues, -a]: Attribute values such as applicationType=iPlanetAMWebAgentService.
[--datafile, -D]: Name of file that contains attribute values data. Possible attributes are resources, subjects, conditions, actions, searchIndexImpl, saveIndexImpl, resourceComparator, subjectAttributeNames and entitlementCombiner.

ssoadm set-attr-any

Set any member of attribute schema.

Usage: ssoadm set-attr-any --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--any, -y: Attribute Schema Any value
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-bool-values

Set boolean values of attribute schema.

Usage: ssoadm set-attr-bool-values --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributename, -a: Name of attribute.
--falsei18nkey, -j: Internationalization key for false value.
--falsevalue, -z: Value for false.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--truei18nkey, -k: Internationalization key for true value.
--truevalue, -e: Value for true.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-choicevals

Set choice values of attribute schema.

Usage: ssoadm set-attr-choicevals --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributename, -a: Name of attribute.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--add, -p]: Set this flag to append the choice values to existing ones.
[--choicevalues, -k]: Choice value such as o102=Inactive.
[--datafile, -D]: Name of file that contains attribute values data.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-defs

Set default attribute values in schema.

Usage: ssoadm set-attr-defs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-end-range

Set attribute schema end range.

Usage: ssoadm set-attr-end-range --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--range, -r: End range
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-i18n-key

Set i18nKey member of attribute schema.

Usage: ssoadm set-attr-i18n-key --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--i18nkey, -k: Attribute Schema I18n Key
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-start-range

Set attribute schema start range.

Usage: ssoadm set-attr-start-range --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--range, -r: Start range
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-syntax

Set syntax member of attribute schema.

Usage: ssoadm set-attr-syntax --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--syntax, -x: Attribute Schema Syntax
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-type

Set type member of attribute schema.

Usage: ssoadm set-attr-type --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--type, -p: Attribute Schema Type
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-ui-type

Set UI type member of attribute schema.

Usage: ssoadm set-attr-ui-type --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--uitype, -p: Attribute Schema UI Type
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-validator

Set attribute schema validator.

Usage: ssoadm set-attr-validator --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--validator, -r: validator class name
[--subschemaname, -c]: Name of sub schema.

ssoadm set-attr-view-bean-url

Set properties view bean URL member of attribute schema.

Usage: ssoadm set-attr-view-bean-url --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--attributeschema, -a: Name of attribute schema
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--url, -r: Attribute Schema Properties View Bean URL
[--subschemaname, -c]: Name of sub schema.

ssoadm set-entitlement-conf

Set entitlements service configuration

Usage: ssoadm set-entitlement-conf --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
[--attributevalues, -a]: Attribute values such as evalThreadSize=4.
[--datafile, -D]: Name of file that contains attribute values data. Possible attributes are evalThreadSize, searchThreadSize, policyCacheSize and indexCacheSize.

ssoadm set-identity-attrs

Set attribute values of an identity

Usage: ssoadm set-identity-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm set-identity-svc-attrs

Set service attribute values of an identity

Usage: ssoadm set-identity-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm set-inheritance

Set Inheritance value of Sub Schema.

Usage: ssoadm set-inheritance --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--inheritance, -r: Value of Inheritance.
--password-file, -f: File name that contains password of administrator.
--schematype, -t: Type of schema.
--servicename, -s: Name of service.
--subschemaname, -c: Name of sub schema.

ssoadm set-plugin-viewbean-url

Set properties view bean URL of plug-in schema.

Usage: ssoadm set-plugin-viewbean-url --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--interfacename, -i: Name of interface.
--password-file, -f: File name that contains password of administrator.
--pluginname, -g: Name of Plug-in.
--servicename, -s: Name of service.
--url, -r: Properties view bean URL.

ssoadm set-realm-attrs

Set attribute values of a realm.

Usage: ssoadm set-realm-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--append, -p]: Set this flag to append the values to existing ones.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm set-realm-svc-attrs

Set attribute values of a service that is assigned to a realm. Long content for an attribute can be supplied in a file by appending '-file' to the attribute name, and giving the filename as the value.

Usage: ssoadm set-realm-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--append, -p]: Set this flag to append the values to existing ones.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm set-revision-number

Set service schema revision number.

Usage: ssoadm set-revision-number --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--revisionnumber, -r: Revision Number
--servicename, -s: Name of service.

ssoadm set-site-id

Set the ID of a site.

Usage: ssoadm set-site-id --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--siteid, -i: Site’s ID, such as 10
--sitename, -s: Site name, such as mysite

ssoadm set-site-pri-url

Set the primary URL of a site.

Usage: ssoadm set-site-pri-url --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--sitename, -s: Site name, such as mysite
--siteurl, -i: Site’s primary URL, such as http://site.www.example.com:8080

ssoadm set-site-sec-urls

Set Site Secondary URLs.

Usage: ssoadm set-site-sec-urls --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--secondaryurls, -a: Secondary URLs
--sitename, -s: Site name, such as mysite

ssoadm set-sub-cfg

Set sub configuration. Long content for an attribute can be supplied in a file by appending '-file' to the attribute name, and giving the filename as the value.

Usage: ssoadm set-sub-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--operation, -o: Operation (either add/set/delete) to be performed on the sub configuration.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.
--subconfigname, -g: Name of sub configuration.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.
[--realm, -e]: Name of realm (Sub Configuration shall be set to global configuration if this option is not provided).

ssoadm set-svc-attrs

Set service attribute values in a realm. Long content for an attribute can be supplied in a file by appending '-file' to the attribute name, and giving the filename as the value.

Usage: ssoadm set-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm set-svc-i18n-key

Set service schema i18n key.

Usage: ssoadm set-svc-i18n-key --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--i18nkey, -k: I18n Key.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.

ssoadm set-svc-view-bean-url

Set service schema properties view bean URL.

Usage: ssoadm set-svc-view-bean-url --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servicename, -s: Name of service.
--url, -r: Service Schema Properties View Bean URL

ssoadm set-svrcfg-xml

Set server configuration XML to centralized data store

Usage: ssoadm set-svrcfg-xml --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as http://www.example.com:8080/fam
--xmlfile, -X: XML file that contains configuration.

ssoadm show-agent

Show agent profile.

Usage: ssoadm show-agent --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentname, -b: Name of agent.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--includepassword, -p]: Include the hashed password in the export.
[--inherit, -i]: Set this to inherit properties from parent group.
[--outfile, -o]: Filename where configuration is written to.

ssoadm show-agent-grp

Show agent group profile.

Usage: ssoadm show-agent-grp --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentgroupname, -b: Name of agent group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--outfile, -o]: Filename where configuration is written to.

ssoadm show-agent-membership

List agent’s membership.

Usage: ssoadm show-agent-membership --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentname, -b: Name of agent.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-agent-types

Show agent types.

Usage: ssoadm show-agent-types --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm show-app-priv

Show policy set privilege.

Usage: ssoadm show-app-priv --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of policy set privilege
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name

ssoadm show-appl

Show policy set attributes.

Usage: ssoadm show-appl --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Policy set name
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name

ssoadm show-appl-type

Show application type details.

Usage: ssoadm show-appl-type --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Application Type name
--password-file, -f: File name that contains password of administrator.

ssoadm show-auth-modules

Show the supported authentication modules in the system.

Usage: ssoadm show-auth-modules --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm show-data-types

Show the supported data type in the system.

Usage: ssoadm show-data-types --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm show-datastore

Show data store profile.

Usage: ssoadm show-datastore --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of datastore.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-entitlement-conf

Display entitlements service configuration

Usage: ssoadm show-entitlement-conf --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.

ssoadm show-identity-ops

Show the allowed operations of an identity a realm

Usage: ssoadm show-identity-ops --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-identity-svc-attrs

Show the service attribute values of an identity

Usage: ssoadm show-identity-svc-attrs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
--servicename, -s: Name of service.

ssoadm show-identity-types

Show the supported identity type in a realm

Usage: ssoadm show-identity-types --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-members

Show the members of an identity. For example show the members of a role

Usage: ssoadm show-members --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--membershipidtype, -m: Membership identity type.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-memberships

Show the memberships of an identity. For sample show the memberships of an user.

Usage: ssoadm show-memberships --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such as User, Role and Group.
--membershipidtype, -m: Membership identity type.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-privileges

Show privileges assigned to an identity

Usage: ssoadm show-privileges --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--idname, -i: Name of identity.
--idtype, -t: Type of Identity such Role and Group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.

ssoadm show-realm-svcs

Show services in a realm.

Usage: ssoadm show-realm-svcs --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--mandatory, -y]: Include Mandatory services.

ssoadm show-site

Show site profile.

Usage: ssoadm show-site --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--sitename, -s: Site name, such as mysite

ssoadm show-site-members

Display members of a site.

Usage: ssoadm show-site-members --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--sitename, -s: Site name, such as mysite

ssoadm start-recording

Start recording a bundle that contains troubleshooting information, including debug logs, thread dumps, and environment information.

Usage: ssoadm start-recording --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--jsonfile, -J: JSON control file for a recording operation.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as https://am.example.com:8443/am

ssoadm stop-recording

Stop an active recording operation.

Usage: ssoadm stop-recording --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as https://am.example.com:8443/am

ssoadm unregister-auth-module

Unregisters authentication module.

Usage: ssoadm unregister-auth-module --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--authmodule, -a: Java class name of authentication module.
--password-file, -f: File name that contains password of administrator.

ssoadm update-agent

Update agent configuration.

Usage: ssoadm update-agent --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentname, -b: Name of agent.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Properties such as homeaddress=here.
[--datafile, -D]: Name of file that contains properties.
[--set, -s]: Set this flag to overwrite properties values.

ssoadm update-agent-grp

Update agent group configuration.

Usage: ssoadm update-agent-grp --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--agentgroupname, -b: Name of agent group.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Properties such as homeaddress=here.
[--datafile, -D]: Name of file that contains properties.
[--set, -s]: Set this flag to overwrite properties values.

ssoadm update-app-priv

Update a policy set privilege.

Usage: ssoadm update-app-priv --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name for the this delegation
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
[--actions, -a]: Possible values are READ, MODIFY, DELEGATE, ALL
[--description, -p]: Description for the this delegation.

ssoadm update-app-priv-resources

Set policy set privilege resources. Note that policy sets are cached for 30 minutes. Restart OpenAM to apply changes immediately.

Usage: ssoadm update-app-priv-resources --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--application, -t: Policy set name
--name, -m: Name for the this delegation
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
[--add, -p]: Resources are added to this policy set if this option is set. Otherwise, resources in the current policy set privilege will be overwritten.
[--resources, -r]: Resources to delegate. All resources in the policy set will be delegated if this option is absent.

ssoadm update-app-priv-subjects

Set policy set privilege subjects.

Usage: ssoadm update-app-priv-subjects --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name for the this delegation
--password-file, -f: File name that contains password of administrator.
--realm, -e: Realm name
--subjects, -s: Subject name
--subjecttype, -b: Possible values are User or Group
[--add, -p]: Subjects are added to this policy set if this option is set. Otherwise, subjects in the current policy set privilege will be overwritten.

ssoadm update-auth-cfg-entr

Set authentication configuration entries

Usage: ssoadm update-auth-cfg-entr --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of authentication configuration.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--datafile, -D]: Name of file that contains formatted authentication configuration entries in this format name|flag|options. option can be REQUIRED, OPTIONAL, SUFFICIENT, REQUISITE, such as myauthmodule|REQUIRED|my options.
[--entries, -a]: Formatted authentication configuration entries in this format name|flag|options. Option can be REQUIRED, OPTIONAL, SUFFICIENT, REQUISITE, such as myauthmodule|REQUIRED|my options.

ssoadm update-auth-cfg-props

Set authentication configuration properties

Usage: ssoadm update-auth-cfg-props --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of authentication configuration.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: authentication configuration properties, valid configuration keys are: iplanet-am-auth-login-failure-url, iplanet-am-auth-login-success-url and iplanet-am-auth-post-login-process-class.
[--datafile, -D]: Name of file that contains authentication configuration properties.

ssoadm update-auth-instance

Update authentication instance values

Usage: ssoadm update-auth-instance --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of authentication instance.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm update-datastore

Update data store profile.

Usage: ssoadm update-datastore --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--name, -m: Name of datastore.
--password-file, -f: File name that contains password of administrator.
--realm, -e: Name of realm.
[--attributevalues, -a]: Attribute values such as sunIdRepoClass=com.sun.identity.idm.plugins.files.FilesRepo.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm update-entity-keyinfo

Update XML signing and encryption key information in hosted entity metadata.

Usage: ssoadm update-entity-keyinfo --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--entityid, -y: Entity ID
--password-file, -f: File name that contains password of administrator.
[--idpecertalias, -g]: Identity provider encryption certificate aliases.
[--idpscertalias, -b]: Identity provider signing certificate aliases
[--realm, -e]: Realm where entity resides.
[--specertalias, -r]: Service provider encryption certificate aliases
[--spec, -c]: Specify metadata specification, either wsfed, idff or saml2, defaults to saml2
[--spscertalias, -a]: Service provider signing certificate aliases

ssoadm update-server-cfg

Update server configuration.

Usage: ssoadm update-server-cfg --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--servername, -s: Server name, such as http://www.example.com:8080/fam, or enter default to update default server configuration.
[--attributevalues, -a]: Attribute values such as homeaddress=here.
[--datafile, -D]: Name of file that contains attribute values data.

ssoadm update-svc

Update service.

Usage: ssoadm update-svc --options [--global-options]

Options

--adminid, -u: Administrator ID of running the command.
--password-file, -f: File name that contains password of administrator.
--xmlfile, -X: XML file(s) that contains schema.
[--continue, -c]: Continue updating service if one or more previous services cannot be updated.

Set multiple attributes in a single ssoadm command

You can set multiple attributes in a single ssoadm command by using a text file or by specifying multiple attributes with the -a option.

Text file

Create a text file with each property on each line followed by a line feed and save the file for example, as TEXT_FILE:
```
iplanet-am-session-max-session-time=150
iplanet-am-session-max-idle-time=15
iplanet-am-session-max-caching-time=5
```
properties

Run the ssoadm command specifying the name of the file with the --datafile (-D) option:

$ ./ssoadm set-attr-defs \
  --servicename iPlanetAMSessionService \
  --schematype dynamic \
  --adminid uid=amAdmin,ou=People,dc=am,dc=example,dc=com \
  --password-file passwordfile \
  --datafile TEXT_FILE

bash

The `--attributevalues` option

Run ssoadm using the --attributevalues (-a) option. Separate each attribute with a space:

$ ./ssoadm set-attr-defs \
  --servicename iPlanetAMSessionService \
  --schematype dynamic \
  --adminid uid=amAdmin,ou=People,dc=am,dc=example,dc=com \
  --password-file passwordfile \
  --attributevalues \
      iplanet-am-session-max-session-time=150 \
      iplanet-am-session-max-idle-time=15 \
      iplanet-am-session-max-caching-time=5

bash

Deployment configuration

Under Deployment, you can manage different configurations for AM server instances, and site configurations when using multiple AM server instances.

Configure servers

AM server properties reside in two places:

The default configuration, under Configure > Server Defaults.
Per-server basis configuration, under Deployment > Servers > Server Name.

Default server properties are applied to all server instances, and can be overridden on a per-server basis. Changes to the value of a default server property are applied to all servers that are not overriding that property. The ability to set default properties and override them for an individual server lets you keep a set of properties with identical configuration across the environment, while providing the flexibility to change properties on specific servers when required.

A closed lock means inherited, an open lock means localized.

Figure 1. Inherited properties

A closed lock means the property is inherited from the defaults. To change an inherited value click on the lock, and the property will become localized for that server.
An open lock means the property is localized for this server. To return to the inherited values, click on the lock.

The Advanced section also takes values from the defaults, but the properties do not have locks for inheritance. Instead, if you want to override a particular advanced property value on a per-server basis, you need to add that property with its new value under Deployment > Servers > Server Name > Advanced.

After changing server configurations, restart AM or the web application container where AM runs for the changes to take effect unless otherwise noted.

General properties

The General page provides access to properties, such as site configuration, server base installation directory, default locale, debug levels, and other properties.

Site

The following properties are available under the Site tab:

Parent Site: Specifies the site the server belongs to. The drop-down list defaults to [empty} until there is at least one site created in the deployment.

The Site tab is only available by navigating to Deployment > Servers > Server Name > General.

System

The following properties are available under the System tab:

Base installation directory: The directory where AM’s configuration data and logs reside. For example, /path/to/am/.

Property: com.iplanet.services.configpath
Default Locale: Specifies the default locale of the UI pages when the client does not request a locale either by using the locale query string parameter or by setting the HTTP header, Accept-Language.

To set the locale when AM cannot find UI files for the requested locale, set the JVM platform locale instead.

Default: en_US

Property: com.iplanet.am.locale
Notification URL: Specifies the URL of the notification service endpoint. For example, https://am.example.com:8443/am/notificationservice.

Default: %SERVER_PROTO%://%SERVER_HOST%:%SERVER_PORT%/%SERVER_URI%/notificationservice

Property: com.sun.identity.client.notification.url
XML Validation: When enabled, AM validates any XML document it parses.

Default: Off

Property: com.iplanet.am.util.xml.validating

Debugging

The following properties are available under the Debugging tab:

Debug Level: Specifies the log level shared across components for debug logging.

Changes to this property take effect immediately. No server restart is necessary.

Default: Error

Property: com.iplanet.services.debug.level
Merge Debug Files: When enabled, AM writes debug log messages to a single file, debug.out. By default, AM writes a debug log per component.

Changes to this property take effect immediately. No server restart is necessary.

Default:Off

Property: com.iplanet.services.debug.mergeall
Debug Directory: Specifies the path where AM writes debug logs. For example, /path/to/am/var/debug.

Changes to this property do not take effect until you restart the AM server.

Default: %BASE_DIR%/%SERVER_URI%/var/debug

Property: com.iplanet.services.debug.directory

Mail server

The properties under the Mail Server tab configure the email server AM uses to send notification emails, for example, on account lockout.

Mail Server Host Name: The hostname of the SMTP server.

Default: localhost

Property: com.iplanet.am.smtphost
Mail Server Port Number: The port of the SMTP server.

Default: 25

Property: com.iplanet.am.smtpport

This is a different email server to the Email service you configure for user self-service.

Security properties

Most security settings are inherited by default.

Encryption

The following properties are available under the Encryption tab:

Password Encryption Key

The encryption key for decrypting stored passwords.

The value of the am.encryption.pwd property must be the same for all deployed servers in a site. You can set the Password Encryption Key property for all servers at Deployment > Servers > Server Name > Security.

For greater security, store the password encryption key in a keystore and rotate the key periodically:

Set Enable Encryption KeyStore.
Configure the keystore by setting the encryption keystore properties on this page.

You can either reference an existing keystore file or create a new one for this purpose.
Set Encryption Key Alias to the current active key in the keystore.

Learn about creating keystores and aliases in Key aliases and passwords.

If you set Enable Encryption KeyStore and AM finds an encryption key for the mapped alias in the keystore, the Password Encryption Key is ignored.

Example: TF1Aue9c63bWTTY4mmZJeFYubJbNiSE3

Property: am.encryption.pwd

Encryption class

The default class used to handle encryption.

Default: com.iplanet.services.util.JCEEncryption

Property: com.iplanet.security.encryptor

Secure Random Factory Class

The class used to provide AM with cryptographically strong random strings. Possible values are the com.iplanet.am.util.JSSSecureRandomFactoryImpl class for JSS and the com.iplanet.am.util.SecureRandomFactoryImpl class for pure Java.

Default: com.iplanet.am.util.SecureRandomFactoryImpl

Property: com.iplanet.security.SecureRandomFactorImpl

Enable Encryption KeyStore

If enabled, AM gets the password encryption key from the keystore defined on this page.

Default: false

Property: am.encryption.secret.enabled

Encryption Key Alias

The alias of the current active password encryption key in the keystore.

Property: am.encryption.secret.alias

Encryption KeyStore File

The location of the keystore containing the password encryption key, for example, /path/to/am/security/keystores/encryption-keystore.jceks.

Property: am.encryption.secret.keystoreFile

Encryption KeyStore Type

The type of the keystore: JCEKS or PKCS12.

Property: am.encryption.secret.keystoreType

Default: JCEKS

Encryption KeyStore Password File

The location of the file containing the keystore password; for example, /path/to/am/security/secrets/default/.storepass.

Property: am.encryption.secret.keystorePass

Encryption Key Password File

The location of the file containing the keystore key password; for example, /path/to/am/security/secrets/default/.keypass.

Property: am.encryption.secret.keyPass

Validation

The following properties are available under the Validation tab:

Platform Low Level Comm. Max. Content Length: The maximum content length for an HTTP request.

Default: 16384

Property: com.iplanet.services.comm.server.pllrequest.maxContentLength
Client IP Address Check: When enabled, AM checks client IP addresses when creating and validating SSO tokens.

Default: Disabled

Property: com.iplanet.am.clientIPCheckEnabled

The following properties are available under the Cookie tab:

Cookie Name: The name of the cookie AM uses to set a session handler ID during authentication.

Default: iPlanetDirectoryPro

Property: com.iplanet.am.cookie.name
Secure Cookie: When enabled, AM generates secure cookies, which are only transmitted over an encrypted connection like HTTPS.

Default: Disabled

Property: com.iplanet.am.cookie.secure
Encode Cookie Value: When enabled, AM URL-encodes the cookie values.

Default: Disabled

Property: com.iplanet.am.cookie.encode

Key store

The following properties are available under the Key Store tab:

Keystore File: The path to the AM keystore file, for example, /path/to/am/security/keystores/keystore.jceks.

Default: %BASE_DIR%/%SERVER_URI%/keystore.jceks

Property: com.sun.identity.saml.xmlsig.keystore
Keystore Type: The keystore type, for example JKS, JCEKS, PKCS11, or PKCS12.

This can be a custom keystore type, which must be supported by, and configured in, the local Java runtime environment.

Default: JCEKS

Property: com.sun.identity.saml.xmlsig.storetype
Keystore Password File: The path to the password file for the keystore, for example, /path/to/am/security/secrets/default/.storepass. The password contained in this file is in cleartext.

Default: %BASE_DIR%/%SERVER_URI%/.storepass

Property: com.sun.identity.saml.xmlsig.storepass
Private Key Password File: The path to the password file for the private key aliases contained in the keystore, for example, /path/to/am/security/secrets/default/.keypass. The password contained in this file is in cleartext.

Default: %BASE_DIR%/%SERVER_URI%/.keypass

Property: com.sun.identity.saml.xmlsig.keypass
Certificate Alias: Leave the default test alias.

Property: com.sun.identity.saml.xmlsig.certalias

Certificate revocation list caching

The following properties are available under the Certificate Revocation List Caching tab:

LDAP server host name

The hostname of the LDAP server where AM caches the certificate revocation list (CRL).

Property: com.sun.identity.crl.cache.directory.host

LDAP server port number

The port number of the LDAP server where AM caches the certificate revocation list.

Property: com.sun.identity.crl.cache.directory.port

SSL/TLS Enabled

When enabled, AM connects securely to the directory server holding the CRL cache. AM must trust the certificate from the LDAP server if you enable this option.

Default: Disabled

Property: com.sun.identity.crl.cache.directory.ssl

mTLS Enabled

When enabled, AM uses mutual TLS (mTLS) to authenticate to the DS server with trusted certificates.

If you enable mTLS, you must also:

Set SSL/TLS Enabled.
Set a secure port in the Connection String(s) property.
Configure the DS server for mTLS.

Learn more about configuring datastores for mTLS in Secure authentication to datastores.
Map the secret label am.servers.crl.cache.directory.mtls.cert to a certificate in the secret store.

Learn more about configuring certificates and secret store mappings in Secret stores.

If you enable mTLS, AM ignores the values of the LDAP server bind user name and LDAP server bind password properties.
You must restart the server for changes to this setting to take effect.

Default: Disabled

property: com.sun.identity.crl.cache.directory.mtlsenabled

LDAP server bind user name

The bind DN of the service account AM uses to authenticate to the LDAP server holding the CRL cache.

Property: com.sun.identity.crl.cache.directory.user

LDAP server bind password

The bind password of the username set in the LDAP server bind user name property.

Property: com.sun.identity.crl.cache.directory.password

LDAP search base DN

A valid Base DN for the LDAP search, such as dc=example,dc=com.

Property: com.sun.identity.crl.cache.directory.searchlocs

Search Attributes

The DN component of the issuer’s subject DN used to retrieve the CRL in the LDAP server, for example, cn.

Property: com.sun.identity.crl.cache.directory.searchattr

Online certificate status protocol check

The following properties are available under the Online Certificate Status Protocol Check tab:

Check Enabled: When enabled, AM checks the revocation status of certificates using the Online Certificate Status Protocol (OCSP).

Default: Disabled

Property: com.sun.identity.authentication.ocspCheck
Responder URL: The URL for the OCSP responder to contact about the revocation status of certificates.

Property: com.sun.identity.authentication.ocsp.responder.url
Certificate Nickname: The nickname for the OCSP responder certificate set in the Responder URL property.

Property: com.sun.identity.authentication.ocsp.responder.nickname

Object deserialisation class allowlist

Whitelist: A list of classes considered valid when AM performs object deserialization operations.

Default: com.iplanet.dpro.session.DNOrIPAddressListTokenRestriction, com.sun.identity.common.CaseInsensitiveHashMap,com.sun.identity.common.CaseInsensitiveHashSet, com.sun.identity.common.CaseInsensitiveKey, com.sun.identity.common.configuration.ServerConfigXML, com.sun.identity.common.configuration.ServerConfigXML$DirUserObject, com.sun.identity.common.configuration.ServerConfigXML$ServerGroup, com.sun.identity.common.configuration.ServerConfigXML$ServerObject, com.sun.identity.console.base.model.SMSubConfig, com.sun.identity.console.service.model.SMDescriptionData, com.sun.identity.console.service.model.SMDiscoEntryData, com.sun.identity.console.session.model.SMSessionData, com.sun.identity.console.user.model.UMUserPasswordResetOptionsData, com.sun.identity.shared.datastruct.OrderedSet,com.sun.xml.bind.util.ListImpl, com.sun.xml.bind.util.ProxyListImpl, java.lang.Boolean,java.lang.Integer, java.lang.Number,java.lang.StringBuffer, java.net.InetAddress,java.security.cert.Certificate, java.security.cert.Certificate$CertificateRep, java.util.ArrayList,java.util.Collections$EmptyMap, java.util.Collections$EmptySet, java.util.Collections$SingletonList, java.util.HashMap,java.util.HashSet, java.util.LinkedHashSet, java.util.Locale, org.forgerock.openam.authentication.service.protocol.RemoteCookie, org.forgerock.openam.authentication.service.protocol.RemoteHttpServletRequest, org.forgerock.openam.authentication.service.protocol.RemoteHttpServletResponse, org.forgerock.openam.authentication.service.protocol.RemoteServletRequest, org.forgerock.openam.authentication.service.protocol.RemoteServletResponse, org.forgerock.openam.authentication.service.protocol.RemoteSession, org.forgerock.openam.dpro.session.NoOpTokenRestriction

Property: openam.deserialisation.classes.whitelist

Session properties

Session settings are inherited by default.

Session limits

The following properties are available under the Sessions Limits tab:

Maximum Session Cache Size: Specifies the maximum number of sessions to cache in the AM server’s internal session cache.

Default: 5000

Property: org.forgerock.openam.session.service.access.persistence.caching.maxsize
Invalidate Session Max Time: Specifies the time in minutes after which invalid server-side sessions are removed from the session table.

Default: 3 (minutes)

Property: com.iplanet.am.session.invalidsessionmaxtime

Statistics

The following properties are available under the Statistics tab:

Logging Interval (in seconds): Specifies the time in seconds AM delays between logging server-side session statistics. Any value lower than 5 is interpreted as 5 seconds.

Default: 60

Property: com.iplanet.am.stats.interval
State: Specifies whether to write statistics to a File, to the Console, or to turn recording Off.

Default: File

Property: com.iplanet.services.stats.state
Directory: The path where AM writes statistic files, for example, /path/to/am/var/stats.

Default: %BASE_DIR%/%SERVER_URI%/var/stats

Property: com.iplanet.services.stats.directory
Enable Host Lookup: When enabled, AM performs host lookup during server-side session logging.

Default: Disabled

Property: com.sun.am.session.enableHostLookUp

Notification

The following properties are available under the Notification tab:

Notification Pool Size: Specifies the number of threads in the session change notification thread pool. Session notification applies to server-side sessions only.

Default: 10

Property: com.iplanet.am.notification.threadpool.size
Notification Thread Pool Threshold: Specifies the maximum number of tasks in the queue for serving session change notification threads. Session notification applies to server-side sessions only.

Default: 5000

Property: com.iplanet.am.notification.threadpool.threshold

Validation

The following properties are available under the Validation tab:

Case Insensitive client DN comparison: When enabled, AM performs case-insensitive distinguished name comparison.

Default: Enabled

Property: com.sun.am.session.caseInsensitiveDN

SDK properties

Most SDK settings are inherited.

Data store

The following properties are available under the Data Store tab:

Enable Datastore Notification: When enabled, AM uses datastore notification. Otherwise, AM uses in-memory notification.

Changes to this property take effect immediately. No server restart is necessary.

Default: Enabled

Property: com.sun.identity.sm.enableDataStoreNotification
Enable Directory Proxy: When enabled, AM accounts for the use of a directory proxy to access the directory server, for example, by enabling delegation privileges rather than ACIs for access control to the proxy.

Enable this option if you have deployed PingDS as a directory proxy in front of a number of additional DS instances. For more information, see Directory Proxy in the DS documentation.

Default: Disabled

Property: com.sun.identity.sm.ldap.enableProxy
Notification Pool Size: Specifies the size of the thread pool used to send notifications. A value of 1 causes notifications to be processed sequentially, avoiding any potential out-of-order conditions. In production, where configuration is unlikely to change often, keeping the default of 1 is recommended.

Default: 1

Property: com.sun.identity.sm.notification.threadpool.size

Event service

The following properties are available under the Event Service tab:

Number of retries for Event Service connections

Specifies the maximum number of attempts to reestablish event service connections.

Default: 3

Property: com.iplanet.am.event.connection.num.retries

Delay between Event Service connection retries

Specifies the time in milliseconds between attempts to reestablish entry service connections.

Default: 3000

Property: com.iplanet.am.event.connection.delay.between.retries

Error codes for Event Service connection retries

Specifies the LDAP error codes for which AM retries rather than returning failure.

Default: 80,81,91

Property: com.iplanet.am.event.connection.ldap.error.codes.retries

Disabled Event Service Connection

Specifies which persistent search connections AM can disable. Any connection that is not specified as disabled is enabled.

Multiple values should be separated with a comma ,.

Default: aci,um

Property: com.sun.am.event.connection.disable.list

Possible values are:

aci. Obtain notification changes to the aci attribute.
um. Obtain notification changes in AM’s user store. For example, modifying a password.
sm. Obtain notification changes in AM’s configuration store. For example, modifying a realm.

LDAP connection

The following properties are available under the LDAP Connection tab:

Number of retries for LDAP Connection: Specifies the maximum number of attempts to reestablish LDAP connections.

Default: 3

Property: com.iplanet.am.ldap.connection.num.retries
Delay between LDAP connection retries: Specifies the time, in milliseconds, between attempts to reestablish LDAP connections.

Default: 1000

Property: com.iplanet.am.ldap.connection.delay.between.retries
Error Codes for LDAP connection retries: Specifies the LDAP error codes for which AM retries rather than returning failure.

Default: 80,81,91

Property: com.iplanet.am.ldap.connection.ldap.error.codes.retries

Caching and replica

The following properties are available under the Caching and Replica tab:

SDK Caching Max. Size: Specifies the cache size used when SDK caching is enabled. The size should be an integer greater than 0, or the default size of 10000 will be used.

Changes to this property clear the contents of the cache. No server restart is necessary.

Default: 10000

Property: com.iplanet.am.sdk.cache.maxSize
SDK Replica Retries: Specifies the maximum number of attempts to retry when an entry not found error is returned to the SDK.

Changes to this property take effect immediately. No server restart is necessary.

Default: 0

Property: com.iplanet.am.replica.num.retries
Delay between SDK Replica Retries: Specifies the time in milliseconds between attempts to retrieve entries through the SDK.

Changes to this property take effect immediately. No server restart is necessary.

Default: 1000

Property: com.iplanet.am.replica.delay.between.retries

Time to live configuration

The following properties are available under the Time to Live Configuration tab:

Cache Entry Expiration Enabled: When disabled, cache entries expire based on the User Entry Expiration Time property.

Default: Disabled

Property: com.iplanet.am.sdk.cache.entry.expire.enabled
User Entry Expiration Time: Specifies the time in minutes for which user entries remain valid in cache after their last modification. When AM accesses a user entry that has expired, it reads the entry from the directory server instead of from the cache.

Default: 15

Property: com.iplanet.am.sdk.cache.entry.user.expire.time
Default Entry Expiration Time: Specifies the time in minutes for which non-user entries remain valid in cache after their last modification. When AM accesses a non-user entry that has expired, it reads the entry from the directory server instead of from the cache.

Default: 30

Property: com.iplanet.am.sdk.cache.entry.default.expire.time

CTS properties

You can configure the Core Token Service (CTS) to store tokens in the same LDAP directory as the AM configuration or in a separate external directory server. Take note of specific requirements for indexing and replication. In particular, manage WAN replication carefully for optimum performance.

Tune advanced properties related to token size correctly, including com.sun.identity.session.repository.enableEncryption, com.sun.identity.session.repository.enableCompression, and com.sun.identity.session.repository.enableAttributeCompression. For more information, refer to Advanced properties.

CTS token store

Set the following properties on the CTS Token Store tab:

Store Mode

Specifies the datastore where AM stores CTS tokens. Possible values are:

Default Token Store: AM stores CTS tokens in the configuration datastore.
External Token Store: AM stores CTS tokens in an external datastore.

If you specify Default Token Store, you can’t access the configuration properties on the External Store Configuration tab.

Root Suffix

This property sets the base DN for CTS storage. For example, cn=cts,ou=famrecords,ou=openam-session,ou=tokens. The Root Suffix specifies a database that can be maintained and replicated separately from the standard user datastore.

Max Connections

The maximum number of remote connections to the external datastore. For affinity deployments, this property specifies the maximum number of remote connections to each directory server in the connection string.

Default: 100

Find recommended settings in Tune CTS store LDAP connections.

Page Size

The number of results per page returned from the CTS datastore.

If the result set is smaller than the page size, the number of results is never paginated. If the result set is larger, the number of pages returned is the result set size divided by the page size.

Increasing the page size results in fewer round trips to the CTS datastore when retrieving large result sets.

To return all results and disable pagination, set to 0.

Default: 0

VLV Page Size

The number of results per page returned from the underlying CTS datastore when using virtual list views (VLVs). Larger values will result in fewer round trips to the datastore when retrieving large result sets, and VLVs are enabled on the datastore.

Find more information on VLVs in Virtual List View Index in the DS documentation.

Default: 10

External store configuration

The External Store Configuration tab lets you set connection details to one or more external PingDS instances.

Before you can select External Token Store on the CTS Token Store tab, you must complete the connection details on this tab.

SSL/TLS Enabled

Enables a secure connection to the directory server. Connections to PingDS must be secure.

mTLS Enabled

When enabled, AM uses mutual TLS (mTLS) to authenticate to the PingDS using trusted certificates.

When you enable mTLS, AM ignores the values of the Login Id and Password properties.

You must also:

Set SSL/TLS Enabled.
Set a secure port in the Connection String(s) property.

Find information on configuring certificates and keystore mappings in Secret stores.

You must configure the corresponding secret mapping before you enable an mTLS connection to the PingDS. If you try to save an mTLS configuration before configuring the mapping, the UI returns an error.

Start TLS

When enabled, AM uses startTLS to secure the connection to the external directory server.

Connection String(s)

Specifies the ordered list of connection strings for external DS servers. The format is HOST:PORT[|SERVERID[|SITEID]], where HOST:PORT are the LDAP server and its port. SERVERID and SITEID are optional parameters to specify an AM instance that prioritizes the particular connection. This doesn’t exclude other AM instances from using that connection, although they must have no remaining priority connections available to them before they use it.

When a failed DS server becomes available again, AM instances create new connections to it based on the order specified in the list.

Examples for active/passive deployments

cts-ds1.example.com:389,cts-ds2.example.com:389: Every AM instance accesses cts-ds1.example.com:389 for all CTS operations. If it goes down, they access cts-ds2.example.com:389.

Every instance will open new connections to cts-ds1.example.com:389 when it becomes available.
cts-ds1.example.com:389|1|1,cts-ds2.example.com:389|2|1: Server 1 site 1 gives priority to cts-ds1.example.com:389. Server 2 site 1 gives priority to cts-ds2.example.com:389. Any server not specified accesses the first server on the list, while it is available.

If cts-ds1.example.com:389 goes down, server 1 site 1 accesses cts-ds2.example.com:389. Any server not specified accesses the second server on the list.

If cts-ds2.example.com:389 goes down, server 2 site 1 accesses cts-ds1.example.com:389. Any server not specified still accesses the first server on the list.

Server 1 site 1 and any server not specified will open new connections to cts-ds1.example.com:389 when it becomes available. Only server 2 site 1 will open new connections to cts-ds2.example.com:389 when it becomes available.
cts-ds1.example.com:389|1|1,cts-ds2.example.com:389|1|1,cts-ds3.example.com:389|1|2: Server 1 site 1 gives priority to cts-ds1.example.com:389. Any server not specified accesses the first server on the list, while it is available.

If cts-ds1.example.com goes down, server 1 site 1 accesses cts-ds2.example.com:389. Any server not specified accesses the second server on the list.

If both cts-ds1.example.com and cts-ds2.example.com go down, server 1 site 1 accesses cts-ds3.example.com:389 in site 2. Any server not specified accesses the third server on the list.

Server 1 site 1 and any server not specified will open new connections to any server in site 1 when they become available, with cts-ds1.example.com being the preferred server.

Example for affinity deployments

cts-ds1.example.com:389,cts-ds2.example.com:389,cts-ds3.example.com:389,cts-ds4.example.com:389: Access CTS tokens from one of the four servers listed in the connection string. For any given CTS token, AM determines the token’s affinity for one of the four servers, and always accesses the token from that same server. Tokens are distributed equally across the four servers.

Login Id

The DN of the user who authenticates to the external datastore. This user needs sufficient privileges to read and write to the root suffix of the external PingDS.

Password

The password associated with the login ID.

If you enable mTLS, AM ignores the values of the Login Id and Password properties.

Heartbeat

The interval, in seconds, that AM should send a heartbeat request to the PingDS to ensure that the connection isn’t idle. Configure the heartbeat to ensure that network hardware, such as routers and firewalls, doesn’t drop the connection between AM and the directory server.

Default: 10

Affinity Enabled

When enabled, AM accesses the CTS token store in multiple DS instances in an affinity deployment rather than a single PingDS instance in an active/passive deployment.

If you enable this option, make sure that the value of the Connection String(s) property is identical for every server in multi-server deployments.

Default: Disabled

UMA properties

UMA server settings are inherited by default.

UMA resource store

The following settings appear on the UMA Resource Store tab:

Store Mode

Specifies the datastore where AM stores UMA tokens. Possible values are:

Default Token Store: AM stores UMA tokens in the configuration datastore.
External Token Store: AM stores UMA tokens in an external datastore.

Root Suffix

Specifies the base DN for storage information in LDAP format, such as dc=uma-resources,dc=example,dc=com.

Max Connections

Specifies the maximum number of connections to the datastore.

External UMA resource store configuration

AM honors the following properties when External Token Store is selected under the Resource Sets Store tab:

SSL/TLS Enabled: When enabled, AM uses SSL or TLS to connect to the external datastore. Make sure AM trusts the datastore’s certificate when using this option.
Connection String(s): An ordered list of connection strings for external datastores. The format is HOST:PORT[|SERVERID[|SITEID]], where HOST:PORT specify the FQDN and port of the datastore, and SERVERID and SITEID are optional parameters that let you prioritize the particular connection when used by the specified node(s).

Multiple connection strings must be comma-separated, for example, uma-ldap1.example.com:389|1|1, uma-ldap2.example.com:389|2|1.

You can find more syntax examples in the entry for Connection String(s) in CTS properties.
Login Id: The username AM uses to authenticate to the datastore. For example, uid=am-uma-bind-account,ou=admins,dc=uma,dc=example,dc=com. This user must be able to read and write to the root suffix of the datastore.
Password: The password associated with the login ID property.
Heartbeat: The time period, in seconds, that AM should send a heartbeat request to the datastore to ensure that the connection does not remain idle.

Default: 10

UMA audit store

The following settings appear on the UMA Audit Store tab:

Store Mode

Specifies the datastore where AM stores audit information generated when users access UMA resources. Possible values are:

Default Token Store: AM stores UMA audit information in the configuration datastore.
External Token Store: AM stores UMA audit information in an external datastore.

Root Suffix

Specifies the base DN for storage information in LDAP format, such as dc=uma-audit,dc=example,dc=com.

Max Connections

Specifies the maximum number of connections to the datastore.

External UMA audit store configuration

AM honors the following properties when External Token Store is selected under the UMA Audit Store tab:

SSL/TLS Enabled: When enabled, AM uses SSL or TLS to connect to the external datastore. Make sure AM trusts the datastore’s certificate when using this option.
Connection String(s): An ordered list of connection strings for external datastores. The format is HOST:PORT[|SERVERID[|SITEID]], where HOST:PORT specify the FQDN and port of the datastore, and SERVERID and SITEID are optional parameters that let you prioritize the particular connection when used by the specified node(s).

Multiple connection strings must be comma-separated, for example, uma-ldap1.example.com:389|1|1, uma-ldap2.example.com:389|2|1.

You can find more syntax examples in the entry for Connection String(s) in CTS properties.
Login Id: The username AM uses to authenticate to the datastore. For example, uid=am-uma-bind-account,ou=admins,dc=uma,dc=example,dc=com. This user must be able to read and write to the root suffix of the datastore.
Password: The password associated with the login ID property.
Heartbeat: The time period, in seconds, that AM should send a heartbeat request to the datastore to ensure that the connection does not remain idle.

Default: 10

Pending requests store

The following settings appear on the Pending Requests Store tab:

Store Mode

Specifies the datastore where AM stores pending requests to UMA resources. Possible values are:

Default Token Store: AM stores UMA pending requests in the configuration datastore.
External Token Store: AM stores UMA pending requests in an external datastore.

Root Suffix

Specifies the base DN for storage information in LDAP format, such as dc=uma-pending,dc=example,dc=com.

Max Connections

Specifies the maximum number of connections to the datastore.

External pending requests store configuration

AM honors the following properties when External Token Store is selected under the Pending Requests Store tab:

SSL/TLS Enabled: When enabled, AM uses SSL or TLS to connect to the external datastore. Make sure AM trusts the datastore’s certificate when using this option.
Connection String(s): An ordered list of connection strings for external datastores. The format is HOST:PORT[|SERVERID[|SITEID]], where HOST:PORT specify the FQDN and port of the datastore, and SERVERID and SITEID are optional parameters that let you prioritize the particular connection when used by the specified node(s).

Multiple connection strings must be comma-separated, for example, uma-ldap1.example.com:389|1|1, uma-ldap2.example.com:389|2|1.

You can find more syntax examples in the entry for Connection String(s) in CTS properties.
Login Id: The username AM uses to authenticate to the datastore. For example, uid=am-uma-bind-account,ou=admins,dc=uma,dc=example,dc=com. This user must be able to read and write to the root suffix of the datastore.
Password: The password associated with the login ID property.
Heartbeat: The time period, in seconds, that AM should send a heartbeat request to the datastore to ensure that the connection does not remain idle.

Default: 10

UMA resource labels store

The following settings appear on the UMA Resource Labels Store tab:

Store Mode

Specifies the datastore where AM stores user-created labels used for organizing UMA resources. Possible values are:

Default Token Store: AM stores user-created labels in the configuration datastore.
External Token Store: AM stores user-created labels in an external datastore.

Root Suffix

Specifies the base DN for storage information in LDAP format, such as dc=uma-resources-labels,dc=example,dc=com.

Max Connections

Specifies the maximum number of connections to the datastore.

External UMA resource labels store configuration

AM honors the following properties when External Token Store is selected under the UMA Resource Labels Store tab.

SSL/TLS Enabled: When enabled, AM uses SSL or TLS to connect to the external datastore. Make sure AM trusts the datastore’s certificate when using this option.
Connection String(s): An ordered list of connection strings for external datastores. The format is HOST:PORT[|SERVERID[|SITEID]], where HOST:PORT specify the FQDN and port of the datastore, and SERVERID and SITEID are optional parameters that let you prioritize the particular connection when used by the specified node(s).

Multiple connection strings must be comma-separated, for example, uma-ldap1.example.com:389|1|1, uma-ldap2.example.com:389|2|1.

You can find more syntax examples in the entry for Connection String(s) in CTS properties.
Login Id: The username AM uses to authenticate to the datastore. For example, uid=am-uma-bind-account,ou=admins,dc=uma,dc=example,dc=com. This user must be able to read and write to the root suffix of the datastore.
Password: The password associated with the login ID property.
Heartbeat: The time period, in seconds, that AM should send a heartbeat request to the datastore to ensure that the connection does not remain idle.

Default: 10

Directory configuration properties

Configure connection settings and additional LDAP directory server instances by navigating to Deployment > Servers > Server Name > Directory Configuration.

Directory configuration

The following properties are available under the Directory Configuration tab:

Minimum Connection Pool: Sets the minimum number of connections in the pool.

Changes to this property take effect immediately. No server restart is necessary.
Maximum Connection Pool: Sets the maximum number of connections in the pool.

Changes to this property take effect immediately. No server restart is necessary.
Bind DN: Sets the bind DN of the service account AM uses to connect to the configuration directory servers.

Changes to this property take effect immediately. No server restart is necessary.
Bind Password: Set the bind password to connect to the configuration directory servers.

Changes to this property take effect immediately. No server restart is necessary.

Server

In the LDAP connection table, edit existing LDAP connections by selecting the pen icon to the right of the row you want to modify. To add a new entry, fill the NAME, HOST NAME, PORT NUMBER and CONNECTION TYPE columns using the following hints:

NAME. The name of the LDAP connection.
HOST NAME. The FQDN of the LDAP server.
PORT NUMBER. The port number to connect to the LDAP server.
CONNECTION TYPE. Whether the connection between the LDAP server and AM is SIMPLE (unsecured) or SSL (secured).

Advanced properties

Each server has a list of advanced properties that can be modified at Deployment > Servers > Server Name > Advanced. For a list of inherited advanced properties relevant to all servers, go to Configure > Server Defaults > Advanced.

bootstrap.file

File that contains the path to the AM configuration folder. By default, the .openamcfg directory is created in the home directory of the user that runs the web container. For example, /usr/local/.openamcfg/AMConfig_usr_local_apache-tomcat-8.0.35_webapps_am_.

com.iplanet.am.cookie.c66Encode

Properly URL encode session tokens.

Default: true

com.iplanet.am.daemons

This property was used only for authentication with modules and chains and is no longer documented.

com.iplanet.am.directory.ssl.enabled

If true AM connects to the configuration directory server over LDAPS.

Default: false

com.iplanet.am.installdir

AM Configuration and log file location.

Default: ~/openam/, such as ~/am

com.iplanet.am.jssproxy.checkSubjectAltName

When using JSS or JSSE, check whether the name values in the SubjectAltName certificate match the server FQDN.

Default: false

com.iplanet.am.jssproxy.resolveIPAddress

When using JSS or JSSE, check that the IP address of the server resolves to the host name.

Default: false

com.iplanet.am.jssproxy.SSLTrustHostList

When using JSS or JSSE, comma-separated list of server FQDNs to trust if they match the certificate CN, even if the domain name isn’t correct.

com.iplanet.am.jssproxy.trustAllServerCerts

When using JSS or JSSE, set to true to trust whatever certificate is presented without checking.

Default: true

com.iplanet.am.lbcookie.name

Used with sticky load balancers that can inspect the cookie value.

Default: amlbcookie

com.iplanet.am.lbcookie.value

Used with sticky load balancers that can inspect the cookie value. The value of this property defaults to the unique AM server ID, although you can set your own unique value.

To improve AM server performance, keep the value of the cookie set to the AM server ID when using Web Agents.

If you have replaced the value of this property and you need to match the AM server URLs with their corresponding server IDs, query the global-config/servers endpoint. For example:

$ curl \
--request GET \
--header "Accept: application/json" \
--header "iPlanetDirectoryPro: AQIC5…NDU1*" \
'https://am.example.com:8443/am/json/global-config/servers?_queryFilter=true'
{
  "result": [
    {
      "_id": "01",
      "_rev": "1372703177",
      "url": "https://am.example.com:8443/am",
      "siteName": null
    }
  ],
  "resultCount": 1,
  "pagedResultsCookie": null,
  "totalPagedResultsPolicy": "NONE",
  "totalPagedResults": -1,
  "remainingPagedResults": -1
}

bash

In the example, the server ID for server https://am.example.com:8443/am is 01.

Default: 01

com.iplanet.am.pcookie.name

Persistent cookie name.

Default: DProPCookie

com.iplanet.am.profile.host

Not used

Default: server-host, such as am.example.com

com.iplanet.am.profile.port

Not used

Default: server-port, such as 8080 or 8443

com.iplanet.am.sdk.caching.enabled

Enables caching for configuration data and user data.

Learn more in the Overall server cache settings section.

Changes to this property take effect immediately. No server restart is necessary.

Default: true

com.iplanet.am.session.agentSessionIdleTime

Time in minutes after which a web or Java agent’s server-side session expires. Note that this setting is ignored when AM creates a client-side session for a web or Java agent.

Default: 1440 (session expires after one day). You can set this property to 0 (session never expires), or any integer higher than 30 (no maximum limit).

com.iplanet.am.session.client.polling.enable

If true, client applications such as web or Java agents poll for server-side session changes. If false, client applications register listeners for notifications about changes to server-side sessions.

Default: false

com.iplanet.am.session.client.polling.period

If client applications poll for changes, number of seconds between polls.

Default: 180

com.iplanet.am.session.httpSession.enabled

Create an HttpSession for users on successful authentication.

Default: true

com.iplanet.security.SSLSocketFactoryImpl

SSL socket factory implementation used by AM.

Default: com.sun.identity.shared.ldap.factory.JSSESocketFactory, uses a pure Java provider

com.sun.identity.am.cookie.check

If true, AM checks for cookie support in the user agent and returns an error if cookies aren’t supported.

Default: false

com.sun.identity.appendSessionCookieInURL

If true, AM appends the session cookie to the URL for a zero page session.

Default: true

com.sun.identity.auth.cookieName

Cookie used by the AM authentication service to handle the authentication process.

Default: AMAuthCookie

com.sun.identity.authentication.client.ipAddressHeader

Set the name of the HTTP header that AM can examine to learn the client IP address when requests go through a proxy or load balancer. (When requests go through an HTTP proxy or load balancer, checking the IP address on the request alone returns the address of the proxy or load balancer rather than that of the client.) AM must be able to trust the proxy or load balancer to set the client IP address correctly in the header specified.

Example: com.sun.identity.authentication.client.ipAddressHeader=X-Forwarded-For

com.sun.identity.authentication.multiple.tabs.used

If true, users can open many browser tabs to the login page at the same time without encountering an error.

Default: false

com.sun.identity.authentication.setCookieToAllDomains

If true, AM allows multiple cookie domains.

Default: true

com.sun.identity.authentication.special.users

List of special users always authenticated against the local directory server.

Default: cn=dsameuser,ou=DSAME Users,dc=openam,dc=example,dc=com

com.sun.identity.authentication.super.user

Identifies an administrative user that replaces the amAdmin user. For example, uid=superroot,ou=people,dc=example,dc=com.

You must manually create a user account for the new administrative user in the configuration datastore that has the same privileges as the uid=admin user.

The amAdmin account is "hard-coded" in the source of several files. The code in these files may affect the functionality of a top-level administrative user with a name other than amAdmin.

Default: uid=amAdmin,ou=People,dc=openam,dc=forgerock,dc=org

com.sun.identity.authentication.uniqueCookieName

When cookie hijacking protection is configured, name of the cookie holding the URL to the AM server that authenticated the user.

Default: sunIdentityServerAuthNServer

com.sun.identity.client.notification.url

Notification service endpoint for clients such as web and Java agents.

Default: server-protocol://server-host:server-port/server-uri/notificationservice, such as https://am.example.com:8443/am/notificationservice

com.sun.identity.common.systemtimerpool.size

Number of threads in the shared system timer pool used to schedule operations such as session timeout.

Default: 3

com.sun.identity.cookie.httponly

When set to true, mark cookies as HTTPOnly to prevent scripts and third-party programs from accessing the cookies.

Note that this configuration option is used only in non-UI deployments. The UI cannot set the HttpOnly name in a cookie.

Default: false

com.sun.identity.cookie.samesite

Configures support for applying SameSite cookie rules, as per internet-draft Cookies:HTTP State Management Mechanism.

Available settings are as follows:

strict

Requests originating from different domains won’t have cookies sent with them.

When this mode is enabled, any AM functionality that relies on requests being redirected back to the AM instance may not operate correctly. For example, OAuth 2.0 flows and SAML federation may not operate correctly if AM can’t access the required cookies.

lax

Cookies received from different domains can’t be accessed unless the request is a top-level request and uses a "safe" HTTP method, such as GET, HEAD, OPTIONS, and TRACE.

off

AM applies no restrictions on cookie domains.

You must disable SameSite support if any of the following is true:

You must set Access-Control-Allow-Credentials=true in your CORS configuration.

Learn more about configuring CORS in AM in Configure CORS support.
You are using SAML HTTP-POST bindings.

For example, IdP-initiated single logout (SLO) functionality won’t operate correctly if SameSite support is enabled, as the iPlanetDirectoryPro cookie wouldn’t be accessible in cross-domain POST requests. Learn more in Implement SSO and SLO.

Default: off

com.sun.identity.enableUniqueSSOTokenCookie

If true, AM uses protection against cookie hijacking.

Default: false

com.sun.identity.jss.donotInstallAtHighestPriority

If false, JSS takes priority over other providers.

Default: true

com.sun.identity.monitoring

Activates AM monitoring.

Default: off

com.sun.identity.monitoring.local.conn.server.url

URL for local connection to the monitoring service.

Default: service:jmx:rmi://

com.sun.identity.password.deploymentDescriptor

Internal property used by AM.

Default: server-uri, such as am

com.sun.identity.policy.Policy.policy_evaluation_weights

Weights of the cost of evaluating policy subjects, rules, and conditions. Evaluation is in order of the heaviest weight to the lightest.

Default: 10:10:10, meaning evaluation of rules, then conditions, then subjects

com.sun.identity.policy.resultsCacheMaxSize

Maximum number of policy decisions AM caches.

Default: 10000

com.sun.identity.security.checkcaller

If true, AM performs a Java security permissions check.

Default: false

com.sun.identity.server.fqdnMap

Enables virtual hosts, partial hostname and IP address. Maps invalid or virtual name keys to valid FQDN values for proper redirection.

To map myserver to myserver.example.com, set com.sun.identity.server.fqdnMap[myserver]=myserver.example.com.

com.sun.identity.session.repository.enableAttributeCompression

For additional compression of CTS token JSON binaries, beyond GZip, if desired.

Default: false

com.sun.identity.session.repository.enableCompression

For GZip-based compression of CTS tokens, if desired.

Default: false

com.sun.identity.session.repository.enableEncryption

Enables tokens to be encrypted when stored.

Multi-instance deployments require consistent use of this property, which should be configured under Configure > Server Defaults > Advanced.

The am.encryption.pwd property must also be the same for all deployed instances. You can set the Password Encryption Key property under Deployment > Servers > Server Name > Security. Verify that all servers have the same setting for this property.

Default: false

com.sun.identity.sm.cache.enabled

Enables service configuration caching.

Find important information about this property in Overall server cache settings.

Changes to this property take effect immediately. No server restart is necessary.

Default: true

com.sun.identity.sm.cache.ttl

When service configuration caching time-to-live is enabled, this sets the time to live in minutes.

Changes to this property take effect immediately. No server restart is necessary.

Default: 30

com.sun.identity.sm.cache.ttl.enable

If service configuration caching is enabled, whether to enable a time-to-live for cached configuration.

Changes to this property take effect immediately. No server restart is necessary.

Default: false

com.sun.identity.sm.flatfile.root_dir

File system directory to hold file-based representation of AM configuration.

Default: /path/to/am/

com.sun.identity.sm.sms_object_class_name

Class used to read and write AM service configuration entries in the directory.

Default: com.sun.identity.sm.SmsWrapperObject

com.sun.identity.url.readTimeout

Used to set the read timeout in milliseconds for HTTP and HTTPS connections to other servers.

Default: 30000

com.sun.identity.urlchecker.dorequest

If true, AM sends an HTTP GET request to the com.sun.identity.urlchecker.targeturl as a health check against another server in the same site.

If false, AM only checks the Socket connection and doesn’t send an HTTP GET request.

If each AM server runs behind a reverse proxy, then the default setting of true means the health check actually runs against the AM instance, rather than checking only the Socket to the reverse proxy.

Default: true

com.sun.identity.urlchecker.targeturl

URL to monitor when com.sun.identity.urlchecker.dorequest is set to true.

Default: URL to the /am/namingservice endpoint on the remote server

com.sun.identity.urlconnection.useCache

If true, AM caches documents for HTTP and HTTPS connections to other servers.

Default: false

com.sun.identity.webcontainer

Name of the web container to correctly set character encoding, if necessary.

Default: WEB_CONTAINER

console.privileged.users

Used to assign privileged console access to particular users. Set to a | separated list of users' Universal IDs, such as console.privileged.users=uid=bjensen,ou=user,dc=am,dc=example,dc=com|uid=scarter,ou=user,dc=am,dc=example,dc=com.

openam.auth.destroy_session_after_upgrade

Where to destroy the old session after a session is successfully upgraded.

Default: true

openam.auth.session_property_upgrader

Class that controls which session properties are copied during session upgrade, where default is to copy all properties to the upgraded session.

Default: org.forgerock.openam.authentication.service.DefaultSessionPropertyUpgrader

openam.auth.version.header.enabled

The X-DSAMEVersion http header provides detailed information about the version of AM currently running on the system, including the build and date/time of the build. AM will need to be restarted once this property is enabled.

Default: false

openam.authentication.ignore_goto_during_logout

If true, AM ignores the goto query string parameter on logout and displays the logout page instead.

Default: false

openam.cdm.default.charset

Character set used for globalization.

Default: UTF-8

openam.forbidden.to.copy.headers

Comma-separated list of HTTP headers not to copy when the distributed authentication server forwards a request to another distributed authentication server.

Default: connection

openam.forbidden.to.copy.request.headers

Comma-separated list of HTTP headers not to copy when the distributed authentication server forwards a request to another distributed authentication server.

Default: connection

openam.retained.http.request.headers: Comma-separated list of HTTP headers to copy to the forwarded request when the server forwards a request to another server.

Requests are forwarded when the server receiving the request isn’t the server that originally initiated authentication. The server that originally initiated authentication is identified by a session ID stored in the AMAuthCookie cookie.

On subsequent requests, the server receiving the request checks the cookie. If the cookie identifies another server, the current server forwards the request to that server.

When a reverse proxy is set up to provide the client IP address in the X-Forwarded-For header, if your deployment includes multiple AM servers, then this property must be set to include the header.

Example: openam.retained.http.request.headers=X-DSAMEVersion,X-Forwarded-For

AM copies the header when forwarding a request to the authoritative server where the client originally began the authentication process, so that the authoritative AM server receiving the forwarded request can determine the real client IP address.

Use the openam.retained.http.headers property to retain headers to return in the response to the AM server that forwarded the request.

Default: X-DSAMEVersion
openam.session.case.sensitive.uuid: If true, universal user IDs are considered case-sensitive when matching them.

Default: false

org.forgerock.allow.http.client.debug

Specifies whether AM can output logging at the Message level for the org.apache.http.wire and org.apache.http.headers logging appenders.

Possible values are:

true. The appenders' debug log level can take the same value as AM’s, even Message.

The appenders can log cleartext passwords or sensitive information related to client interactions. For example, scripted authentication or STS transactions.

Enable this property for debugging purposes only when required.

false. The appender’s debug log level is always warning, unless debug is disabled.

You can also set this property as a JVM option in the container where AM runs.
Default: false

org.forgerock.openam.http.ssl.connection.manager

The class that implements the org.forgerock.openam.http.SslConnectionManager interface, which controls both keystore and truststore settings, as well as hostname verification.

If the container in which AM runs is configured with the java.protocol.handler.pkgs property set, then ensure this property is set to com.sun.identity.protocol.AmSslConnectionManager.

In previous versions of AM, this property was named opensso.protocol.handler.pkgs, and required a value of com.sun.identity.protocol if the java.protocol.handler.pkgs property was set by the container.

org.forgerock.openam.audit.identity.activity.events.blacklist

A comma-separated list of audit events that won’t be logged.

For example, AM-ACCESS-ATTEMPT,AM-GROUP-CHANGE.

Logging all events can impact performance. You should log only those events you intend to monitor.

Changes to this property require a server restart.

Default: AM-ACCESS-ATTEMPT,AM-IDENTITY-CHANGE,AM-GROUP-CHANGE

org.forgerock.openam.authLevel.excludeRequiredOrRequisite

This property was used only for authentication with modules and chains and is no longer documented.

org.forgerock.openam.auth.audit.nodes.enabled

When true, AM generates audit log messages for each authentication node reached during authentication tree flows.

Possible values are true or false.

Default: true

org.forgerock.openam.auth.audit.trees.enabled

When true, AM generates audit log messages with the outcome of authentication tree flows.

Possible values are true or false.

Default: true

org.forgerock.openam.auth.transactionauth.returnErrorOnAuthFailure

Specifies whether AM returns an HTTP 200 or HTTP 401 message when the user fails to complete the required actions to perform session upgrade during transactional authorization. Possible values are:

false. AM returns an HTTP 200 message with the original SSO token.

For example:
```
{
    "tokenId": "AQIC5wM...TU3OQ*",
    "successUrl": "http://example.com/index.html",
    "realm": "/"
}
```
json
In this case, the user is redirected to the success URL and, when trying to access the protected resource, policy evaluation will fail since transactional authorization has failed.

true. AM returns an HTTP 401 message.

For example:

{
    "code":401,
    "reason":"Unauthorized",
    "message":"Login failure",
    "detail":{
        "failureUrl":"http://example.com/unauthorized.html"
    }
}

json

In this case, the user is redirected to the failure URL.

Default: false

org.forgerock.openam.authentication.accountExpire.days

Days until account expiration set after successful authentication by the account expiration post-authentication plugin.

Default: 30

org.forgerock.openam.authentication.forceAuth.enabled

This property was used only for authentication with modules and chains and is no longer documented.

org.forgerock.openam.console.autocomplete.enabled

Specifies whether input forms and password fields can be autocompleted. This property only affects end-user pages in the classic UI. Possible values are true, to enable autocomplete, and false, to disable it.

Default: true

org.forgerock.openam.core.resource.lookup.cache.enabled

Controls whether the results of resource file lookup should be cached.

While you are customizing the UI as described in UI customization, set this property to false to allow AM immediately to pick up changes to the files as you customize them.

Reset this to the default, true, when using AM in production.

Default: true

org.forgerock.openam.core.sms.always.fail.on.invalid.attributes

Specifies whether the server should throw an exception, when it encounters an unknown attribute while parsing file-based configurations. By default, the server ignores any unknown attributes, and doesn’t throw an exception. To override this behavior, set this property to true.

Default: false

org.forgerock.openam.core.sms.placeholder_api_enabled

For file-based configurations, enables property value substitution.

Takes the following values:

ON enables property value substitution for all property types.
STRING_ONLY enables property value substitution for properties with string values only.
OFF disables property value substitution.

Default: OFF

The recommended way to enable property value substitution is through a Java system property, rather than with this advanced server property.

org.forgerock.openam.cts.rest.enabled: Enables access to the CTS REST endpoint /json/tokens.

Even when access to the CTS REST endpoint is enabled, only the AM global administrator has authorization to perform operations against /json/tokens.

Default: false

After changing this property, you must restart AM or the container in which it runs for the change to take effect.
org.forgerock.openam.httpclienthandler.system.clients.connection.timeout: The time new client connections using the client handler will wait before timing out.

The value is a string specifying a number and a unit of time.

Restart AM or the container in which it runs for the change to take effect.

Default: 10 seconds
org.forgerock.openam.httpclienthandler.system.clients.max.connections: The maximum number of connections allowed in the pool available for clients using the client handler.

Use this property only when the org.forgerock.openam.httpclienthandler.system.clients.reuse.connections.enabled advanced server property is enabled.

Restart AM or the container in which it runs for the change to take effect.

Default: 64
org.forgerock.openam.httpclienthandler.system.clients.pool.ttl: The maximum time-to-live, in milliseconds, for pooled client connections using the client handler.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set
org.forgerock.openam.httpclienthandler.system.clients.response.timeout: The time a client using the client handler will wait for a response before timing out.

The value is a string specifying a number and a unit of time.

Restart AM or the container in which it runs for the change to take effect.

Default: 10 seconds
org.forgerock.openam.httpclienthandler.system.clients.retry.failed.requests.enabled: Specifies whether the client handler should retry failed connections. Possible values are true or false.

Restart AM or the container in which it runs for the change to take effect.

Default: true
org.forgerock.openam.httpclienthandler.system.clients.reuse.connections.enabled: When true the client handler pools and reuses connections. Possible values are true or false.

Restart AM or the container in which it runs for changes to this property to take effect.

Default: true
org.forgerock.openam.httpclienthandler.system.nonProxyHosts: Lists the target hosts for which requests shouldn’t be proxied. Use commas to separate hostnames.

This property supports wildcards at the start and end of any value. For example, *.example.com would result in a match for customers.example.com and staff.example.com, and requests wouldn’t be proxied for those target hosts.

Configure alongside the org.forgerock.openam.httpclienthandler.system.proxy.uri and org.forgerock.openam.httpclienthandler.system.proxy.username advanced server properties.

Store the proxy password in a secret store, instead of in the configuration. Use the secret label am.servers.httpclienthandler.proxy.secret to map an alias for the password.

If AM finds a matching secret for the am.servers.httpclienthandler.proxy.secret label in a secret store, AM ignores the org.forgerock.openam.httpclienthandler.system.proxy.password advanced server property.

Default: localhost,127.*,[::1],0.0.0.0,[::0]
org.forgerock.openam.httpclienthandler.system.proxy.enabled: When set to true, AM routes outgoing HttpClientHandler requests through the HTTP proxy defined on the JVM.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set
org.forgerock.openam.httpclienthandler.system.proxy.password: The password of the proxy that AM uses to route outgoing client handler requests.

For greater security, store the proxy password in a secret store, instead of in the configuration. Use the secret label am.servers.httpclienthandler.proxy.secret to map an alias for the password.

If AM finds a matching secret for the am.servers.httpclienthandler.proxy.secret label in a secret store, AM ignores the org.forgerock.openam.httpclienthandler.system.proxy.password advanced server property.

Configure alongside the org.forgerock.openam.httpclienthandler.system.proxy.username, org.forgerock.openam.httpclienthandler.system.proxy.uri, and org.forgerock.openam.httpclienthandler.system.nonProxyHosts advanced server properties.

If you change this password in the configuration, you must restart AM or the container in which it runs for the change to take effect. If you store the proxy password in a secret store, you can rotate the secret without having to restart AM.

Default: Not set
org.forgerock.openam.httpclienthandler.system.proxy.uri: The URI of the proxy that AM will use to route outgoing client handler requests. The URI must be in the format scheme://hostname:port. For example, https://myproxy.example.com:443.

If the proxy requires authentication, also configure the org.forgerock.openam.httpclienthandler.system.proxy.username and, optionally, the org.forgerock.openam.httpclienthandler.system.nonProxyHosts property.

Store the proxy password in a secret store. and use the secret label am.servers.httpclienthandler.proxy.secret to map an alias for the password. If AM finds a matching secret for the am.servers.httpclienthandler.proxy.secret label in a secret store, AM ignores the org.forgerock.openam.httpclienthandler.system.proxy.password advanced server property.

This property takes precedence over the org.forgerock.openam.httpclienthandler.system.proxy.enabled advanced server property and its related JVM properties.

Learn more in Configure AM for outbound communication.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set
org.forgerock.openam.httpclienthandler.system.proxy.username: The username of the proxy AM will use to route outgoing client handler requests.

Configure alongside the org.forgerock.openam.httpclienthandler.system.proxy.password and org.forgerock.openam.httpclienthandler.system.proxy.uri advanced server properties.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set
org.forgerock.openam.idm.attribute.names.lower.case: Specifies whether the fields in JSON responses are always returned in lowercase. When true, AM converts the fields to lowercase.

Default: false

org.forgerock.openam.introspect.token.query.param.allowed

Specifies whether AM allows HTTP GET requests, and the use of token as a query parameter in POST requests, on the oauth2/introspect endpoint.

For security reasons, and in accordance with the OAuth 2.0 Token Introspection specification, AM disallows HTTP GET requests on the introspection endpoint, and requires HTTP POST requests instead. AM also disallows the use of token as a query parameter in a POST request on that endpoint; for example, /oauth2/introspect?token=access-token.

If your clients in an existing deployment need to send a GET request or token as a query parameter to the oauth2/introspect endpoint, you can change this setting to true. However, it is recommended that you adjust your clients to use the more secure setting.

Default: false

org.forgerock.openam.ldap.default.time.limit

Configures the client-side timeout, in milliseconds, applied to LDAP operations performed with the Netscape LDAP SDK.

Default: 0 (no time limit)

org.forgerock.openam.ldap.dncache.expire.time

Sets the DN cache timeout, in milliseconds, after which an entry should be removed from the cache. A value of 0 means that the DN cache won’t expire, and entries won’t be removed automatically.

Setting this value too low can have a severe performance impact.

Default: 0 (no time limit)

org.forgerock.openam.ldap.heartbeat.timeout

The number of seconds AM should wait for a heartbeat operation to the DS server to complete, before considering the connection unavailable.

Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. You can turn this off by setting the value to 0.

Default: 10

org.forgerock.openam.ldap.secure.protocol.version: The protocols AM uses to connect to a secure LDAP server.

Specify a single value, for example TLSv1.2, for AM to use only that protocol when connecting to affected external resources. Learn more in Secure network communication.

Specify a comma-separated list with multiple protocols for AM to use the most secure protocol supported by the external resources.

A value of TLSv1.3,TLSv1.2 means that AM attempts to use the TLSv1.3 protocol to connect to the configuration and user *s, but if a TLSv1.3 connection isn’t supported, AM uses TLSv1.2.

Default: TLSv1.3,TLSv1.2
org.forgerock.openam.notifications.agents.enabled: Controls whether to publish notifications for consumption by web agents and Java agents.

Learn more about notifications in the Web Agents Maintenance Guide and the Java Agents Maintenance Guide.

Default: true

org.forgerock.openam.oauth2.checkIssuerForIdTokenInfo: If set to true, a query to the /oauth2/idtokeninfo endpoint validates the iss (issuer) claim against the AM issuers. If the value of the iss claim differs from the AM issuer, AM returns the following error:

bad_request: Invalid id token issuer

Default: false

org.forgerock.openam.oauth2.tokenexpiry.skewAllowance: The period, in seconds, during which an OIDC ID token remains valid after its expiry time.

This property allows for clock skews between servers.

Default: 300 (5 minutes)

org.forgerock.openam.oauth2.client.graceperiod.disabled

Lets you override the default maximum refresh token grace period.

By default, you cannot set a grace period that exceeds 120 seconds. Setting this server property to true disables the maximum and lets you set any grace period up to the maximum positive integer value. This value affects the refresh token grace period set in the OAuth2.0 provider configuration or on any OAuth 2.0 clients.

Having a long grace period poses a security risk. You should therefore keep the grace period as small as possible. Exceeding the default maximum of 120 seconds is not recommended.

Default: false

org.forgerock.openam.oidc.SocialProvider.sub.claim.is.not.unique: By default, OIDC social authentication flows use the sub claim to identify the subject, in accordance with the OIDC specification, which mandates that the sub claim should uniquely identify the user.

However, some identity providers don’t provide a unique value for the sub claim. In this case, you can set this property to true. When set to true, AM uses the value of the Auth ID Key in the social provider configuration to identify the subject.

Default: false
org.forgerock.openam.openidconnect.allow.open.dynamic.registration: Controls whether OpenID Connect clients can register dynamically without providing an access token.

If you set this to true in production, take care to limit or throttle dynamic client registrations.

Default: false
org.forgerock.openam.radius.server.context.cache.size: Maximum number of RADIUS client sessions that can be cached concurrently on the AM server.

Default: 5000

org.forgerock.openam.redirecturlvalidator.maxUrlLength

Specifies the maximum length of redirection URLs validated by AM. The Validation Service and other AM services perform redirection URL validation. Learn more in Configure trusted URLs.

The default value should be adequate in most cases. Increase the default value as needed if messages similar to the following appear in your debug log files with message-level debugging enabled:

RedirectUrlValidator.isRedirectUrlValid: The url was length 2015 which is longer than the allowed maximum of 2000

Default: 2000

org.forgerock.openam.request.max.bytes.entity.size

Specifies the maximum size of the body of any request made to AM. Learn more in Limit the size of the request body.

The property is hot-swappable. You don’t need to restart AM for the changes to take effect.

Default: 1 MB (1048576 bytes)

org.forgerock.openam.secrets.keystore.keyid.provider

Specifies the name of the KeyStoreKeyIdProvider implementation AM uses to provide key ID (kids) to public keys when AM is configured as an OAuth 2.0 authorization server.

Learn more in Customizing Public Key IDs.

Default: org.forgerock.openam.secrets.DefaultKeyStoreKeyIdProvider.

org.forgerock.openam.secrets.googlekms.decryptionkey

Specifies the fully qualified resource ID of the Google Cloud KMS secret used to decrypt secrets as they are read from the filesystem, environment variables, or system properties.

This property may also specify the Google Cloud KMS secret used to decrypt the hash of the password of the amAdmin user, if the value of the org.forgerock.openam.secrets.special.user.passwords.format advanced server property is set to GOOGLE_KMS_ENCRYPTED.

Only one key can be specified at a time.

Learn more in Using Google Cloud KMS Secrets to Decrypt AM Secrets and Store the amAdmin password in a secret store.

This property has no default.

org.forgerock.openam.secrets.special.user.passwords.format

The format used to store the hash of the amAdmin user password.

Possible values are:

ENCRYPTED_PLAIN. The hash is encrypted with the AM encryption key.
PLAIN. The hash is unencrypted. The password must be randomly generated and have high entropy.
GOOGLE_KMS_ENCRYPTED. The hash is encrypted with the Google Cloud KMS secret specified in the org.forgerock.openam.secrets.googlekms.decryptionkey advanced server property.

Learn more in Store the amAdmin password in a secret store.

Default: ENCRYPTED_PLAIN

org.forgerock.openam.secrets.special.user.secret.refresh.seconds

The period, in seconds, after which the special administrator secret cache expires.

Learn more in Store the amAdmin password in a secret store.

Default: 900 (15 minutes)

org.forgerock.openam.session.stateless.encryption.method

Sets the encryption method for client-side sessions. Possible values are:

A128CBC-HS256. AES 128-bit in CBC mode using HMAC-SHA-256-128 hash (HS256 truncated to 128 bits)
A192CBC-HS384. AES 192-bit in CBC mode using HMAC-SHA-384-192 hash (HS384 truncated to 192 bits)
A256CBC-HS512. AES 256-bit in CBC mode using HMAC-SHA-512-256 hash (HS512 truncated to 256 bits)
A128GCM. AES 128-bit in GCM mode
A192GCM. AES 192-bit in GCM mode
A256GCM. AES 256-bit in GCM mode

Default: A128CBC-HS256

org.forgerock.openam.session.stateless.logout.cache.expiryCheckIntervalSeconds

The period (in seconds) after which the logout token cache purges expired entries. Changes to this property require a server restart.

Default: 60

Learn more in Invalidate all sessions for a user.

org.forgerock.openam.session.stateless.rsa.padding

Sets the padding mode for RSA encryption of client-side sessions. Possible values are:

RSA1_5. RSA with PKCS#1 v1.5 padding.
RSA-OAEP. RSA with OAEP and SHA-1.
RSA-OAEP-256. RSA with OAEP padding and SHA-256.

Default: RSA-OAEP-256

org.forgerock.openam.session.stateless.signing.allownone

Specifies whether signing client-side sessions is enabled. When true, AM allows selecting NONE as the signing algorithm for client-side sessions under Configure > Global Services > Session > Client-Side Sessions.

org.forgerock.openam.smtp.system.connect.timeout

Specifies the amount of time, in milliseconds, that AM waits before considering that an outbound SMTP connection is unavailable.

Default: 10000

org.forgerock.openam.smtp.system.socket.read.timeout

Specifies the amount of time, in milliseconds, that AM waits for an SMTP read request to receive an acknowledgement before returning an error.

Default: 10000

org.forgerock.openam.smtp.system.socket.write.timeout

Specifies the amount of time, in milliseconds, that AM waits for an SMTP write request to receive an acknowledgement before returning an error.

Default: 10000

org.forgerock.openam.slf4j.enableTraceInMessage

Controls whether trace-level logging messages are generated when message-level debug logging is enabled in AM.

Certain components that run in AM’s JVM write a large volume of trace-level debug records that aren’t required for troubleshooting in many cases. With this option set to false, trace-level debug records aren’t written for these components.

If you set this to true in production, take care to monitor the amount of disk space occupied by the AM debug logs.

Default: false

org.forgerock.openam.sso.providers.list

Specifies an ordered list of SSO providers. AM chooses the first applicable provider depending on the context for the requested SSO operation.

Default: org.forgerock.openidconnect.ssoprovider.OpenIdConnectSSOProvider, org.forgerock.openam.sso.providers.stateless.StatelessSSOProvider

org.forgerock.openam.trees.consumedstatedata.cache.size

Specifies the maximum number of trees in a realm for which to cache the results of "state" scans.

AM recursively scans the nodes and paths in authentication trees to determine the state data that each node consumes. Caching this information for a number of trees in each realm means AM doesn’t have to make multiple calls to get the tree’s structure.

If you have many complex authentication trees and a large number of realms, increasing this value may reduce the impact on performance of the consumed state scans.

Default: 15

org.forgerock.openam.xui.user.session.validation.enabled

Changes the UI’s behavior when an authenticated session expires. Possible values are false, where the user notices that their session has expired when trying to interact with the UI and they are redirected to the login screen, or true, where AM redirects the user to a page with the session expired message when their session expires. This prevents the display of possible sensitive information on the screen after a session expires.

This setting doesn’t apply to those users that are global or realm administrators, for example, amAdmin.

Default: true

org.forgerock.openidconnect.ssoprovider.maxcachesize

Maximum size in entries of the OpenIdConnectSSOProvider provider’s cache. This cache is used to map OIDC tokens to SSO tokens for quick lookup.

Default: 5000

org.forgerock.policy.subject.evaluation.cache.size

Maintains a record of subject IDs matched or not matched in a given session. The cache is keyed on the token ID and the session is cleared when destroyed.

Default: 10000

org.forgerock.security.entitlement.enforce.realm: By default, calls to the subjectattributes endpoint are enforced per realm.

Learn more in Query subject attributes.

Default: true

org.forgerock.security.oauth2.enforce.sub.claim.uniqueness

Specifies the format of the subject (sub) claim of an OAuth 2.0 access token, logout token, and OIDC ID token.

AM accepts tokens that use the old sub format, even if you enable this property. Before enabling this property, ensure that your clients can use the new sub claim format, or a combination of the sub and the subname claims.

About the subname Claim

The value of the subname claim matches the value of the sub claim used in versions of AM earlier than 7.1. It also matches the value of the sub claim if you disable the org.forgerock.security.oauth2.enforce.sub.claim.uniqueness property.

An example of the value of the subname claim is bjensen, or myOauth2Client.

AM adds this claim to access and ID tokens by default.

If you don’t want the subname claim added by default, disable the Include subname claim in tokens issued by the OAuth2 Provider property in the OAuth2 Provider service configuration.

Default: true for new installations, false for upgrades

Possible values are:

false.

The value of the sub claim is the username of the identity, or the name or the client that’s the subject of the token.

For example, bjensen, or myOauth2Client.
true.

The subject claim is in the format (type!subject), where:
- subject is the identifier of the user/identity, or the name of the OAuth 2.0/OpenID Connect client that is the subject of the token.
- type can be one of the following:
  - age. Indicates the subject is an OAuth 2.0/OpenID Connect-related user-agent or client. For example, an OAuth 2.0 client, a Remote Consent Service agent, and a Web and Java Agent internal client.
  - usr. Indicates the subject is a user/identity.

For example, (usr!bjensen), or (age!myOAuth2Client).

org.forgerock.services.cts.reaper.cache.pollFrequencyMilliseconds

How often to poll the reaper cache for tokens that have expired, and delete them.

By default, an AM instance will review its cache for tokens eligible for deletion every 100 milliseconds.

Default: 100 (milliseconds)

Learn more in Tune the CTS.

org.forgerock.services.cts.reaper.cache.size

The number of records an AM instance will store in its CTS reaper cache.

Default: 500000

Learn more in Tune the CTS.

org.forgerock.services.cts.reaper.search.gracePeriodMilliseconds

Specifies a grace period used when searching for expired tokens. Any tokens that expired more than the specified duration ago are returned.

Default: 300000 (milliseconds)

Learn more in Tune the CTS.

org.forgerock.services.cts.reaper.search.pollFrequencyMilliseconds

How often to perform a search for expired tokens in the CTS persistence store.

Default: 5000 (milliseconds)

Learn more in Tune the CTS.

org.forgerock.services.cts.reaper.search.tokenLimit

The maximum number of expired tokens to return to the AM reaper when searching the CTS store.

Default: 5000

Learn more in Tune the CTS.

org.forgerock.services.cts.store.ttlsupport.enabled

Specifies whether AM support for the DS entry expiration and deletion feature is enabled. Enabling this setting causes AM to clone the value of the coreTokenExpirationDate attribute to the coreTokenTtlDate attribute during token creation, which allows DS to index tokens using the coreTokenTtlDate attribute for the entry expiration and deletion feature.

This property doesn’t clone the values of tokens that were created before the setting was enabled.

Set this property to true in conjunction with the org.forgerock.services.cts.store.ttlsupport.exclusionlist advanced server property when you need to configure the AM reaper to manage the expiration time for a subset of the tokens in the CTS store only.

Learn more in Manage expired CTS tokens.

Default: false

org.forgerock.services.cts.store.reaper.enabled

Specifies whether the AM reaper is enabled.

Don’t disable the AM reaper unless you have a system in place to clean up expired tokens, such as the DS entry expiration and deletion feature.

Set this property to true in the following scenarios:

When the AM reaper must manage the expiration times for all the tokens in the CTS store.
When the AM reaper must manage the expiration time for a subset of the tokens in the CTS store.

Learn more in Manage expired CTS tokens.

Default: true

org.forgerock.services.cts.store.ttlsupport.exclusionlist

When the org.forgerock.services.cts.store.ttlsupport.enabled advanced server property is set to true, this property specifies a list of token types which won’t have their coreTokenExpirationDate data cloned. For example, SESSION.

The AM reaper will delete the excluded tokens when they expire.

The CTS token store lists the token types in use in your environment.

Learn more in Manage expired CTS tokens.
Default: Not set

org.forgerock.services.datalayer.connection.timeout

Timeout in seconds for LDAP connections to the configuration *.

Default: 10 (seconds)

Find the suggested settings in Tuning CTS Store LDAP Connections.

org.forgerock.services.datalayer.connection.timeout.cts.async

Timeout in seconds for LDAP connections used for most CTS operations.

Default: 10 (seconds)

Find the suggested settings in Tuning CTS Store LDAP Connections.

org.forgerock.services.datalayer.connection.timeout.cts.reaper

Timeout in seconds for the LDAP connection used for CTS token cleanup.

Default: None (don’t time out)

Find the suggested settings in Tuning CTS Store LDAP Connections.

org.forgerock.session.stateless.jwtcache.expiry.time

The maximum time, in seconds, that AM caches client-side session JWTs.

Setting a long cache timeout may be more efficient, but AM won’t detect if a client-side session JWT has expired or has become invalid until the cache expires.

The property is hot-swappable. You don’t need to restart AM for the changes to take effect.

Default: 10

org.forgerock.session.stateless.jwtcache.size

The size, in bytes, of the cache where AM stores client-side session JWTs.

Default: 10000

org.forgerock.openam.ldap.keepalive.search.base

Defines the search base for:

The heartbeat request that checks connections to the LDAP server are alive and prevents idle timeouts (keepalive).
The load balancer availability check.

The LDAP server connection pool will be marked as unavailable if the search fails with an error, returns no entries, or if more than one entry is returned.

If the search results in an error, AM fails to start up with an exception such as org.forgerock.opendj.ldap.ConnectionException: Connect Error: No operational connection factories available.

Default: [Empty]

org.forgerock.openam.ldap.keepalive.search.filter

Defines the search filter for:

The heartbeat request that checks connections to the LDAP server are alive and prevents idle timeouts (keepalive).
The load balancer availability check.

You can also use the absolute True and False filter (&).

The LDAP server connection pool will be marked as unavailable if the search fails with an error, returns no entries, or if more than one entry is returned.

If the search results in an error, AM fails to start up with an exception such as org.forgerock.opendj.ldap.ConnectionException: Connect Error: No operational connection factories available.

Default: (objectClass=*)

org.forgerock.am.auth.trees.authenticate.identified.identity: During authentication, AM records the type of user identified in an identity store. When this setting is enabled, AM uses these stored identities to decide which user to log in.

This lets the authentication trees engine correctly resolve identities that have the same username.

Learn more in the custom node documentation and scripted decision node API.

Default: true

Configure sites

Sites involve multiple AM servers working together to provide services. You can use sites with load balancers and session high availability to configure pools of servers capable of responding to client requests in highly available fashion.

Name: Sets the name of the site.
Primary URL: Sets the primary entry point to the site, such as the URL, to the load balancer for the site configuration.
Secondary URLs: Sets alternate entry points to the site.

Services configuration

You can configure AM services in two places:

Under Configure > Global Services, you can set defaults for a range of AM services. These services affect all the realms in AM.
Under Realms > Realm Name > Services, you can enable, remove, or configure different services for the realm.

Android Key Attestation Service

Realm defaults

The following settings appear on the Realm Defaults tab:

Certificate revocation status list URL: The URL to retrieve the certificate revocation status list (CRL).

Keys are checked against the revocation status list to ensure they have not been revoked or suspended.

Keys can be revoked for a number of reasons, including mishandling or suspected extraction by an attacker.

Defaults to the list maintained by Google at https://android.googleapis.com/attestation/status.
Google hardware attestation root certificate URL: The URL for retrieving the Google hardware attestation root certificates.

Refer to Verifying hardware-backed key pairs with Key Attestation in the Android developer documentation.

If you don’t provide a URL, you must map the certificate using the secret label am.services.attestation.google.public.key.

For more information, refer to Map and rotate secrets.
Cache duration (hours): The number of hours to cache the certificate revocation status list and Google hardware attestation root certificate.

Defaults to one day (24).

Specify 0 to prevent caching.

Audit logging

amster service name: audit

Global attributes

The following settings appear on the Global Attributes tab:

Audit logging

Enable audit logging in AM.

Default value: true

amster attribute: auditEnabled

Field whitelist filters

AM has a predefined allowlist that only records values that do not contain sensitive information. Use this property to allowlist fields in addition to the built-in list.

Each field filter should be provided using a JSON Pointer-like syntax which is prefixed with the event’s topic. The topic will be one of access, activity, authentication, or config.

For example, to record the values of the Accept-Language HTTP header in access events, the pointer is /access/http/request/headers/accept-language.

amster attribute: whitelistFieldFilters

Field blacklist filters

Denylist filters can be used to remove audit event fields which are allowlisted by default. These are fields which are safe to log but which you have decided are not necessary for your requirements.

Each field filter should be provided using a JSON Pointer-like syntax which is prefixed with the event’s topic. The topic will be one of access, activity, authentication, or config.

For example, you might want to filter out surnames by hiding the sn field from activity events. To do so, add the following pointers to the Field blacklist filters list:

/activity/before/sn
/activity/after/sn

amster attribute: blacklistFieldFilters

Realm defaults

The following settings appear on the Realm Defaults tab:

Audit logging

Enable audit logging in AM.

Default value: true

amster attribute: auditEnabled

Field whitelist filters

AM has a predefined allowlist that only records values that do not contain sensitive information. Use this property to allowlist fields in addition to the built-in list.

Each field filter should be provided using a JSON Pointer-like syntax which is prefixed with the event’s topic. The topic will be one of access, activity, authentication, or config.

For example, to record the values of the Accept-Language HTTP header in access events, the pointer is /access/http/request/headers/accept-language.

amster attribute: whitelistFieldFilters

Field blacklist filters

Denylist filters can be used to remove audit event fields which are allowlisted by default. These are fields which are safe to log but which you have decided are not necessary for your requirements.

Each field filter should be provided using a JSON Pointer-like syntax which is prefixed with the event’s topic. The topic will be one of access, activity, authentication, or config.

For example, you might want to filter out surnames by hiding the sn field from activity events. To do so, add the following pointers to the Field blacklist filters list:

/activity/before/sn
/activity/after/sn

amster attribute: blacklistFieldFilters

Secondary configurations

This service has the following secondary configurations.

JMS

The JMS audit event handler is deprecated.

A configured secondary instance of the JMS type has the following tabs:

General handler configuration

The General Handler Configuration tab contains the following secondary configuration properties:

Enabled

Enables or disables an audit event handler.

Default value: true

amster attribute: enabled

Topics

List of topics handled by an audit event handler.

Default value:

access
activity
config
authentication

amster attribute: topics

Audit event handler factory

The Audit Event Handler Factory tab contains the following secondary configuration properties:

Factory Class Name: The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.

Default value: org.forgerock.openam.audit.events.handlers.JmsAuditEventHandlerFactory

amster attribute: handlerFactory

JMS configuration

The JMS Configuration tab contains the following secondary configuration properties:

Delivery Mode

Specifies whether JMS messages used to transmit audit events use persistent or non-persistent delivery.

With persistent delivery, the JMS provider ensures that messages are not lost in transit in case of a provider failure by logging messages to storage when they are sent.

Specify the delivery mode as persistent if it is unacceptable for delivery of audit events to be lost in JMS transit. If the possible loss of audit events is acceptable, choose non-persistent delivery, which provides better performance.

Default value: NON_PERSISTENT

amster attribute: deliveryMode

Session Mode

Specifies the JMS session acknowledgement mode.

The following values are supported:

AUTO. Auto mode guarantees once-only delivery of JMS messages used to transmit audit events.
CLIENT. Client mode does not ensure delivery.
DUPS_OK. Duplicates OK mode ensures that messages are delivered at least once.

Use the default setting unless your JMS broker implementation requires otherwise. See your broker documentation for more information.

Default value: AUTO

amster attribute: sessionMode

JNDI Context Properties

Specifies JNDI properties that AM uses to connect to the JMS message broker to which AM will publish audit events.

AM acts as a JMS client, using a JMS connection factory to connect to your JMS message broker. In order for AM to connect to the broker, the JNDI context properties must conform to those needed by the broker. See the documentation for your JMS message broker for required values.

The default properties are example properties for connecting to Apache ActiveMQ.

Default value:

{
    &quot;java.naming.factory.initial&quot;: &quot;org.apache.activemq.jndi.ActiveMQInitialContextFactory&quot;,
    &quot;topic.audit&quot;: &quot;audit&quot;,
    &quot;java.naming.provider.url&quot;: &quot;tcp://localhost:61616&quot;
}

amster attribute: jndiContextProperties

JMS Topic Name

JNDI lookup name for the JMS topic

Default value: audit

amster attribute: jndiTopicName

JMS Connection Factory Name

Specifies the JNDI lookup name for the connection factory exposed by your JMS message broker. AM performs a JNDI lookup on this name to locate your broker’s connection factory.

See the documentation for your JMS message broker for the required value.

The default is the connection factory name for Apache ActiveMQ.

Default value: ConnectionFactory

amster attribute: jndiConnectionFactoryName

Batch events

The Batch Events tab contains the following secondary configuration properties:

Capacity: Maximum event count in the batch queue; additional events are dropped.

Default value: 1000

amster attribute: batchCapacity
Max Batched: Maximum number of events per batch.

Default value: 100

amster attribute: maxBatchedEvents
Writing Interval: The interval (in seconds) for reading events from the buffer to transmit via jms.

Default value: 10

amster attribute: pollTimeoutSec

JSONStdout

A configured secondary instance of the JSONStdout type has the following tabs:

General handler configuration

The General Handler Configuration tab contains the following secondary configuration properties:

Enabled

Enables or disables an audit event handler.

Default value: true

amster attribute: enabled

Topics

List of topics handled by an audit event handler.

Default value:

access
activity
config
authentication

amster attribute: topics

Audit event handler factory

The Audit Event Handler Factory tab contains the following secondary configuration properties:

Factory Class Name: The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.

Default value: org.forgerock.openam.audit.events.handlers.JsonStdoutAuditEventHandlerFactory

amster attribute: handlerFactory

JSON configuration

The JSON Configuration tab contains the following secondary configuration properties:

ElasticSearch JSON Format Compatible: JSON format should be transformed to be compatible with ElasticSearch format restrictions.

Default value: false

amster attribute: elasticsearchCompatible

Elasticsearch

This configuration was used only for the deprecated Elasticsearch audit handler and is no longer documented.

Syslog

The Syslog audit event handler is deprecated.

A configured secondary instance of the Syslog type has the following tabs:

General handler configuration

The General Handler Configuration tab contains the following secondary configuration properties:

Enabled

Enables or disables an audit event handler.

Default value: true

amster attribute: enabled

Topics

List of topics handled by an audit event handler.

Default value:

access
activity
config
authentication

amster attribute: topics

Audit event handler factory

The Audit Event Handler Factory tab contains the following secondary configuration properties:

Factory Class Name: The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.

Default value: org.forgerock.openam.audit.events.handlers.SyslogAuditEventHandlerFactory

amster attribute: handlerFactory

Syslog configuration

The Syslog Configuration tab contains the following secondary configuration properties:

Server hostname: Host name or IP address of receiving syslog server.

amster attribute: host
Server port: Port number of receiving syslog server.

amster attribute: port
Transport Protocol: Default value: TCP

amster attribute: transportProtocol
Connection timeout: Timeout for connecting to syslog server, in seconds.

amster attribute: connectTimeout
Facility: Syslog facility value to apply to all events.

Default value: USER

amster attribute: facility

Buffering

The Buffering tab contains the following secondary configuration properties:

Buffering Enabled: Enables or disables audit event buffering.

Default value: true

amster attribute: bufferingEnabled
Buffer Size: Maximum number of events that can be buffered (default/minimum: 5000)

Default value: 5000

amster attribute: bufferingMaxSize

CSV

The CSV audit event handler is deprecated.

A configured secondary instance of the CSV type has the following tabs:

General handler configuration

The General Handler Configuration tab contains the following secondary configuration properties:

Enabled

Enables or disables an audit event handler.

Default value: true

amster attribute: enabled

Topics

List of topics handled by an audit event handler.

Default value:

access
activity
config
authentication

amster attribute: topics

Audit event handler factory

The Audit Event Handler Factory tab contains the following secondary configuration properties:

Factory Class Name: The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.

Default value: org.forgerock.openam.audit.events.handlers.CsvAuditEventHandlerFactory

amster attribute: handlerFactory

CSV configuration

The CSV Configuration tab contains the following secondary configuration properties:

Log Directory: Directory in which to store audit log CSV files.

Default value: %BASE_DIR%/var/audit/

amster attribute: location

File rotation

The File Rotation tab contains the following secondary configuration properties:

Rotation Enabled: Enables and disables audit file rotation.

Default value: true

amster attribute: rotationEnabled
Maximum File Size: Maximum size, in bytes, which an audit file can grow to before rotation is triggered. A negative or zero value indicates this policy is disabled.

Default value: 100000000

amster attribute: rotationMaxFileSize
File Rotation Prefix: Prefix to prepend to audit files when rotating audit files.

amster attribute: rotationFilePrefix
File Rotation Suffix: Suffix to append to audit files when they are rotated. Suffix should be a timestamp.

Default value: -yyyy.MM.dd-HH.mm.ss

amster attribute: rotationFileSuffix
Rotation Interval: Interval to trigger audit file rotations, in seconds. A negative or zero value disables this feature.

Default value: -1

amster attribute: rotationInterval
Rotation Times: Durations after midnight to trigger file rotation, in seconds.

amster attribute: rotationTimes

File retention

The File Retention tab contains the following secondary configuration properties:

Maximum Number of Historical Files: Maximum number of backup audit files allowed. A value of -1 disables pruning of old history files.

Default value: 1

amster attribute: retentionMaxNumberOfHistoryFiles
Maximum Disk Space: The maximum amount of disk space the audit files can occupy, in bytes. A negative or zero value indicates this policy is disabled.

Default value: -1

amster attribute: retentionMaxDiskSpaceToUse
Minimum Free Space Required: Minimum amount of disk space required, in bytes, on the system where audit files are stored. A negative or zero value indicates this policy is disabled.

Default value: -1

amster attribute: retentionMinFreeSpaceRequired

Buffering

The Buffering tab contains the following secondary configuration properties:

Buffering Enabled: Enables or disables buffering.

Default value: true

amster attribute: bufferingEnabled
Flush Each Event Immediately: Performance may be improved by writing all buffered events before flushing.

Default value: false

amster attribute: bufferingAutoFlush

Tamper Evident Configuration

The Tamper Evident Configuration tab contains the following secondary configuration properties:

Is Enabled: Enables the CSV tamper evident feature.

Default value: false

amster attribute: securityEnabled
Certificate Store Location: Path to Java keystore.

Default value: %BASE_DIR%/var/audit/Logger.jks

amster attribute: securityFilename
Certificate Store Password: Password for Java keystore.

amster attribute: securityPassword
Signature Interval: Signature generation interval, in seconds.

Default value: 900

amster attribute: securitySignatureInterval

JDBC

The JDBC audit event handler is deprecated.

A configured secondary instance of the JDBC type has the following tabs:

General handler configuration

The General Handler Configuration tab contains the following secondary configuration properties:

Enabled

Enables or disables an audit event handler.

Default value: true

amster attribute: enabled

Topics

List of topics handled by an audit event handler.

Default value:

access
activity
config
authentication

amster attribute: topics

Audit event handler factory

The Audit Event Handler Factory tab contains the following secondary configuration properties:

Factory Class Name: The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.

Default value: org.forgerock.openam.audit.events.handlers.JdbcAuditEventHandlerFactory

amster attribute: handlerFactory

Database Configuration

The Database Configuration tab contains the following secondary configuration properties:

Database Type: Select the database to use for logging audit events.

Identifies the database in use, for example MySQL, Oracle, or SQL.

Default value: oracle

amster attribute: databaseType
JDBC Database URL: URL of the JDBC database.

amster attribute: jdbcUrl
JDBC Driver: Fully qualified JDBC driver class name.

amster attribute: driverClassName
Database Username: Specifies the username to access the database server.

amster attribute: username
Database Password: Specifies the password to access the database server.

amster attribute: password
Connection Timeout (seconds): Specifies the maximum wait time before failing the connection, in seconds.

Default value: 30

amster attribute: connectionTimeout
Maximum Connection Idle Timeout (seconds): Specifies the maximum idle time before the connection is closed, in seconds.

Default value: 600

amster attribute: idleTimeout
Maximum Connection Time (seconds): Specifies the maximum time a JDBC connection can be open, in seconds.

Default value: 1800

amster attribute: maxLifetime
Minimum Idle Connections: Specifies the minimum number of idle connections in the connection pool.

Default value: 10

amster attribute: minIdle
Maximum Connections: Specifies the maximum number of connections in the connection pool.

Default value: 10

amster attribute: maxPoolSize

Buffering

The Buffering tab contains the following secondary configuration properties:

Buffering Enabled: Enables or disables audit event buffering.

Default value: true

amster attribute: bufferingEnabled
Buffer Size (number of events): Size of the queue where events are buffered before they are written to the database.

This queue has to be big enough to store all incoming events that have not yet been written to the database.

If the queue reaches capacity, the process will block until a write occurs.

Default value: 100000

amster attribute: bufferingMaxSize
Write Interval: Specifies the interval (seconds) at which buffered events are written to the database.

Default value: 5

amster attribute: bufferingWriteInterval
Writer Threads: Specifies the number of threads used to write the buffered events.

Default value: 1

amster attribute: bufferingWriterThreads
Max Batched Events: Specifies the maximum number of batched statements the database can support per connection.

Default value: 100

amster attribute: bufferingMaxBatchedEvents

JSON

A configured secondary instance of the JSON type has the following tabs:

General handler configuration

The General Handler Configuration tab contains the following secondary configuration properties:

Enabled

Enables or disables an audit event handler.

Default value: true

amster attribute: enabled

Topics

List of topics handled by an audit event handler.

Default value:

access
activity
config
authentication

amster attribute: topics

Audit event handler factory

The Audit Event Handler Factory tab contains the following secondary configuration properties:

Factory Class Name: The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.

Default value: org.forgerock.openam.audit.events.handlers.JsonAuditEventHandlerFactory

amster attribute: handlerFactory

JSON configuration

The JSON Configuration tab contains the following secondary configuration properties:

Log Directory: Directory in which to store audit log JSON files.

Default value: %BASE_DIR%/var/audit/

amster attribute: location
ElasticSearch JSON Format Compatible: JSON format should be transformed to be compatible with ElasticSearch format restrictions.

Default value: false

amster attribute: elasticsearchCompatible
File Rotation Retention Check Interval: Interval to check time-based file rotation policies, in seconds.

Default value: 5

amster attribute: rotationRetentionCheckInterval

File rotation

The File Rotation tab contains the following secondary configuration properties:

Rotation Enabled: Enables and disables audit file rotation.

Default value: true

amster attribute: rotationEnabled
Maximum File Size: Maximum size, in bytes, which an audit file can grow to before rotation is triggered. A negative or zero value indicates this policy is disabled.

Default value: 100000000

amster attribute: rotationMaxFileSize
File Rotation Prefix: Prefix to prepend to audit files when rotating audit files.

amster attribute: rotationFilePrefix
File Rotation Suffix: Suffix to append to audit files when they are rotated. Suffix should be a timestamp.

Default value: -yyyy.MM.dd-HH.mm.ss

amster attribute: rotationFileSuffix
Rotation Interval: Interval to trigger audit file rotations, in seconds. A negative or zero value disables this feature.

Default value: -1

amster attribute: rotationInterval
Rotation Times: Durations after midnight to trigger file rotation, in seconds.

amster attribute: rotationTimes

File retention

The File Retention tab contains the following secondary configuration properties:

Maximum Number of Historical Files: Maximum number of backup audit files allowed. A value of -1 disables pruning of old history files.

Default value: 1

amster attribute: retentionMaxNumberOfHistoryFiles
Maximum Disk Space: The maximum amount of disk space the audit files can occupy, in bytes. A negative or zero value indicates this policy is disabled.

Default value: -1

amster attribute: retentionMaxDiskSpaceToUse
Minimum Free Space Required: Minimum amount of disk space required, in bytes, on the system where audit files are stored. A negative or zero value indicates this policy is disabled.

Default value: -1

amster attribute: retentionMinFreeSpaceRequired

Buffering

The Buffering tab contains the following secondary configuration properties:

Batch Size: Maximum number of events that can be buffered (default/minimum: 100000)

Default value: 100000

amster attribute: bufferingMaxSize
Write interval: Interval at which buffered events are written to a file, in milliseconds.

Default value: 5

amster attribute: bufferingWriteInterval

Splunk

This configuration was used only for the deprecated Splunk audit handler and is no longer documented.

Base URL source

amster service name: BaseUrlSource

Realm defaults

The following settings appear on the Realm Defaults tab:

Base URL Source

Specifies how the base URL is generated.

The following values are supported:

Extension class (EXTENSION_CLASS). The extension class returns a base URL from a provided HttpServletRequest. In the Extension class name field, enter org.forgerock.openam.services.baseurl.BaseURLProvider.
Fixed value (FIXED_VALUE). The base URL is retrieved from the value specified in the Fixed value base URL field.
Forwarded header (FORWARDED_HEADER). The base URL is retrieved from a forwarded header field in the HTTP request. The Forwarded HTTP header field is standardized and specified in RFC7239.
Host/protocol from incoming request (REQUEST_VALUES). The hostname, server name, and port are retrieved from the incoming HTTP request.
X-Forwarded-* headers (X_FORWARDED_HEADERS). The base URL is retrieved from non-standard header fields, such as X-Forwarded-For, X-Forwarded-By, X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port.

If the X-Forwarded-Proto header is not provided, the server uses a fallback scheme, based on the URI of the request.

If multiple X-Forwarded-Host headers are specified, the outermost proxy host is used.

Default value: REQUEST_VALUES

amster attribute: source

Fixed value base URL

If Fixed value is selected as the Base URL source, enter the base URL in the Fixed value base URL field.

amster attribute: fixedValue

Extension class name

If Extension class is selected as the Base URL source, enter org.forgerock.openam.services.baseurl.BaseURLProvider in the Extension class name field.

amster attribute: extensionClassName

Context path

Specifies the context path for the base URL.

If provided, the base URL includes the deployment context path appended to the calculated URL.

For example, /am.

Default value: /openam

amster attribute: contextPath

Common federation configuration

amster service name: CommonFederationConfiguration

General configuration

The following settings appear on the General Configuration tab:

Maximum allowed content length

The maximum content length allowed in federation communications, in bytes.

Default value: 20480

amster attribute: maxContentLength

Check presence of certificates

Enable checking of certificates against local copy

Whether to verify that the partner’s signing certificate included in the Federation XML document is the same as the one stored in the said partner’s meta data.

The possible values for this property are:

off. Disabled
on. Enabled

Default value: on

amster attribute: certificateChecking

SAML Error Page URL

AM redirects users here when an error occurs in the SAML2 engine.

Both relative and absolute URLs are supported. Users are redirected to an absolute URL using the configured HTTP Binding whereas relative URLs are displayed within the request.

Default value: /saml2/jsp/saml2error.jsp

amster attribute: samlErrorPageUrl

SAML Error Page HTTP Binding

The possible values are HTTP-Redirect or HTTP-POST.

Default value: HTTP-POST

amster attribute: samlErrorPageHttpBinding

Implementation classes

The following settings appear on the Implementation Classes tab:

Datastore SPI implementation class: The Federation system uses this class to get/set user profile attributes.

The default implementation uses the Identity repository APIs to access user profile attributes. A custom implementation must implement the com.sun.identity.plugin.datastore.DataStoreProvider interface.

Default value: com.sun.identity.plugin.datastore.impl.IdRepoDataStoreProvider

amster attribute: datastoreClass
Root URL provider SPI implementation class: The Federation system uses this class to get the root URL of the AM deployment.

The default implementation uses the Root URL APIs to access the AM instance root url. A custom implementation must implement the org.forgerock.openam.federation.plugin.rooturl.RootUrlProvider interface.

Default value: org.forgerock.openam.federation.plugin.rooturl.impl.FmRootUrlProvider

amster attribute: rootUrlProviderClass
ConfigurationInstance SPI implementation class: The Federation system uses this class to fetch service configuration.

The default implementation uses the SMS APIs to access service configuration. A custom implementation must implement the com.sun.identity.plugin.configuration.ConfigurationInstance interface.

Default value: com.sun.identity.plugin.configuration.impl.ConfigurationInstanceImpl

amster attribute: configurationClass
Logger SPI implementation class: The Federation system uses this class to record log entries.

The default implementation uses the Logging APIs to record log entries. A custom implementation must implement the com.sun.identity.plugin.log.Logger interface.

Default value: com.sun.identity.plugin.log.impl.LogProvider

amster attribute: loggerClass
SessionProvider SPI implementation class: The Federation system uses this class to interface with the session service.

The default implementation uses the standard authentication and SSO APIs to access the session service. A custom implementation must implement the com.sun.identity.plugin.session.SessionProvider interface.

Default value: com.sun.identity.plugin.session.impl.FMSessionProvider

amster attribute: sessionProviderClass
PasswordDecoder SPI implementation class: The Federation system uses this class to decode password encoded by AM.

The default implementation uses the internal AM decryption API to decode passwords. A custom implementation must implement the com.sun.identity.saml.xmlsig.PasswordDecoder interface.

Default value: com.sun.identity.saml.xmlsig.FMPasswordDecoder

amster attribute: passwordDecoderClass
SignatureProvider SPI implementation class: The Federation system uses this class to digitally sign SAML documents.

The default implementation uses the XERCES APIs to sign the documents. A custom implementation must implement the com.sun.identity.saml.xmlsig.SignatureProvider interface.

Default value: com.sun.identity.saml.xmlsig.AMSignatureProvider

amster attribute: signatureProviderClass
KeyProvider SPI implementation class: The Federation system uses this class to provide access to the underlying Java keystore.

The default implementation uses the Java Cryptographic Engine to provide access to the Java keystore. A custom implementation must implement the com.sun.identity.saml.xmlsig.KeyProvider interface.

Default value: com.sun.identity.saml.xmlsig.JKSKeyProvider

amster attribute: keyProviderClass

Algorithms

The following settings appear on the Algorithms tab:

XML canonicalization algorithm

The algorithm used to canonicalize XML documents.

The possible values for this property are:

Default value: http://www.w3.org/2001/10/xml-exc-c14n#

amster attribute: cannonicalizationAlgorithm

XML signature algorithm

The algorithm used to sign XML documents.

The possible values for this property are:

Default value: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256

amster attribute: signatureAlgorithm

XML digest algorithm

The default digest algorithm to use in signing XML.

The possible values for this property are:

Default value: http://www.w3.org/2001/04/xmlenc#sha256

amster attribute: DigestAlgorithm

Query String signature algorithm (RSA)

The default signature algorithm to use for RSA keys.

The possible values for this property are:

Default value: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256

amster attribute: QuerySignatureAlgorithmRSA

Query String signature algorithm (DSA)

The default signature algorithm to use for DSA keys.

This property can only take the following value:

http://www.w3.org/2009/xmldsig11#dsa-sha256

Default value: http://www.w3.org/2009/xmldsig11#dsa-sha256

amster attribute: QuerySignatureAlgorithmDSA

Query String signature algorithm (EC)

The default signature algorithm to use for EC keys.

The possible values for this property are:

Default value: http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512

amster attribute: QuerySignatureAlgorithmEC

XML transformation algorithm

The algorithm used to transform XML documents.

The possible values for this property are:

Default value: http://www.w3.org/2001/10/xml-exc-c14n#

amster attribute: transformationAlgorithm

Mask Generation Function Algorithm

Which MGF algorithm to use when encrypting the symmetric encryption key using RSA OAEP algorithm.

The possible values for this property are:

Default value: http://www.w3.org/2009/xmlenc11#mgf1sha256

amster attribute: maskGenerationFunction

AES Key Wrap Algorithm

The AES key wrap algorithm to use when the remote entity provider does not specify which key wrap algorithms it supports.

The possible values for this property are:

Default value: http://www.w3.org/2001/04/xmlenc#kw-aes256

amster attribute: aesKeyWrapAlgorithm

RSA Key Transport Algorithm

The possible values for this property are:

Default value: http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p

amster attribute: rsaKeyTransportAlgorithm

Monitoring

The following settings appear on the Monitoring tab:

Monitoring Agent Provider Class: The Federation system uses this class to gain access to the monitoring system.

The default implementation uses the built-in AM monitoring system. A custom implementation must implement the com.sun.identity.plugin.monitoring.FedMonAgent interface.

Default value: com.sun.identity.plugin.monitoring.impl.AgentProvider

amster attribute: monitoringAgentClass
Monitoring Provider Class for SAML2: The SAML2 engine uses this class to gain access to the monitoring system.

The default implementation uses the built-in AM monitoring system. A custom implementation must implement the com.sun.identity.plugin.monitoring.FedMonSAML2Svc interface.

Default value: com.sun.identity.plugin.monitoring.impl.FedMonSAML2SvcProvider

amster attribute: monitoringSaml2Class

Configuration Version service

amster service name: ConfigurationVersionService

The following settings are available in this service:

configurationCommit: amster attribute: configurationCommit
Configuration Version: AM’s configuration version

Default value: 8.0.0.0

amster attribute: configurationVersion

CORS service

amster service name: CorsConfiguration

Configuration

The following settings appear on the Configuration tab:

Enable the CORS filter: If disable, no CORS headers will be added to responses.

Default value: true

amster attribute: enabled

Secondary configurations

This service has the following secondary configurations.

configuration

Enable the CORS filter: If disable, no CORS headers will be added to responses.

Default value: false

amster attribute: enabled
Accepted Origins: The set of accepted origins.

amster attribute: acceptedOrigins
Accepted Methods: The set of (non-simple) accepted methods, included in the pre-flight response in the header Access-Control-Allow-Methods.

amster attribute: acceptedMethods
Accepted Headers: The set of (non-simple) accepted headers, included in the pre-flight response in the header Access-Control-Allow-Headers.

amster attribute: acceptedHeaders
Exposed Headers: The set of headers to transmit in the header Access-Control-Expose-Headers.

amster attribute: exposedHeaders
Max Age: The max age (in seconds) for caching, included in the pre-flight response in the header Access-Control-Max-Age.

Default value: 0

amster attribute: maxAge
Allow Credentials: Whether to transmit the Access-Control-Allow-Credentials: true header in the response.

Default value: false

amster attribute: allowCredentials

Dashboard

amster service name: DashboardUserService

Realm defaults

The following settings appear on the Realm Defaults tab:

Available Dashboard Apps: List of application dashboard names available by default for realms with the Dashboard service configured.

amster attribute: assignedDashboard

Secondary configurations

This service has the following secondary configurations.

instances

Dashboard Class Name: Identifies how to access the application, for example SAML2ApplicationClass for a SAML v2.0 application.

amster attribute: className
Dashboard Name: The application name as it will appear to the administrator for configuring the dashboard.

amster attribute: name
Dashboard Display Name: The application name that displays on the dashboard client.

amster attribute: displayName
Dashboard Icon: The icon name that will be displayed on the dashboard client identifying the application.

amster attribute: icon
Dashboard Login: The URL that takes the user to the application.

amster attribute: login
ICF Identifier: amster attribute: icfIdentifier

Device Binding service

amster service name: DeviceBindingService

Realm defaults

The following settings appear on the Realm Defaults tab:

Device Binding Attribute

The user’s attribute in which to store bound device data.

The default attribute is added to the schema when you prepare a user store for use with AM. If you want to use a different attribute, you must add it to your user store schema prior to binding devices with AM. AM must be able to write to the attribute.

Default value: boundDevices

amster attribute: deviceBindingAttrName

Device Binding Encryption Scheme

Encryption scheme to use to secure device binding data stored on the server.

AM encrypts the data for each bound device using a unique random secret key with the selected AES encryption standard in CBC mode with PKCS#5 padding. An HMAC-SHA of the selected strength (truncated to half-size) protects the integrity and authenticity of the encryption. AM encrypts the unique random key with the given RSA key pair and stores it with the bound device data.

The possible values for this property are:

Label: AES-256/HMAC-SHA-512 with RSA Key Wrapping (value: RSAES_AES256CBC_HS512)
Label: AES-128/HMAC-SHA-256 with RSA Key Wrapping (value: RSAES_AES128CBC_HS256)
Label: No encryption of device settings (value: NONE)

Default value: NONE

amster attribute: deviceBindingSettingsEncryptionScheme

Encryption Key Store

Path to the key store from which to load encryption keys.

For greater security, store the encryption key information in a secret store, instead of in the configuration. Use the secret label am.services.devicebinding.encryption to map an alias for Device Binding service secrets.

If you update encryption key information in the configuration or in the secret stores, users with existing device profiles will no longer be able to log in using this service. Delete the user’s device profile from their entry in the identity store so that the user can create a new one when they next log in.

If AM finds a matching secret for the am.services.devicebinding.encryption label in a secret store, this value is ignored.

Default value: /path/to/openam/security/keystores/keystore.jks

amster attribute: deviceBindingSettingsEncryptionKeystore

Key Store Type

Type of key store to load.

PKCS#11 key stores require hardware support such as a security device or smart card, which are not available by default in most JVM installations.

Learn more in the JDK 17 PKCS#11 Reference Guide.

If AM finds a matching secret for the am.services.devicebinding.encryption label in a secret store, this value is ignored.

The possible values for this property are:

Label: Java Key Store (JKS) (value: JKS)
Label: Java Cryptography Extension Key Store (JCEKS) (value: JCEKS)
Label: PKCS#11 Hardware Crypto Storage (value: PKCS11)
Label: PKCS#12 Key Store (value: PKCS12)

Default value: JKS

amster attribute: deviceBindingSettingsEncryptionKeystoreType

Key Store Password

Password to unlock the key store. AM encrypts this password when you save it in the configuration. You should modify the default value.

If AM finds a matching secret for the am.services.devicebinding.encryption label in a secret store, this value is ignored.

amster attribute: deviceBindingSettingsEncryptionKeystorePassword

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt bound device data.

If AM finds a matching secret for the am.services.devicebinding.encryption label in a secret store, this value is ignored.

amster attribute: deviceBindingSettingsEncryptionKeystoreKeyPairAlias

Private Key Password

Password to unlock the private key.

If AM finds a matching secret for the am.services.devicebinding.encryption label in a secret store, this value is ignored.

amster attribute: deviceBindingSettingsEncryptionKeystorePrivateKeyPassword

Device ID service

amster service name: deviceIdService

Realm defaults

The following settings appear on the Realm Defaults tab:

Profile Storage Attribute

The user’s attribute in which to store Device ID profiles.

The default attribute is added to the schema when you prepare a user store for AM. If you want to use a different attribute, make sure you add it to your user store schema before creating journeys that use device data. AM must be able to write to the attribute.

Default value: devicePrintProfiles

amster attribute: deviceIdAttrName

Device Profile Encryption Scheme

Encryption scheme to use to secure device profiles stored on the server.

If enabled, each device profile is encrypted using a unique random secret key using the given strength of AES encryption in CBC mode with PKCS#5 padding. An HMAC-SHA of the given strength (truncated to half-size) is used to ensure integrity protection and authenticated encryption. The unique random key is encrypted with the given RSA key pair and stored with the device profile.

The possible values for this property are:

Label: AES-256/HMAC-SHA-512 with RSA Key Wrapping (value: RSAES_AES256CBC_HS512)
Label: AES-128/HMAC-SHA-256 with RSA Key Wrapping (value: RSAES_AES128CBC_HS256)
Label: No encryption of device settings (value: NONE)

Default value: NONE

amster attribute: deviceIdSettingsEncryptionScheme

Encryption Key Store

Path to the key store from which to load encryption keys.

For greater security, store encryption key information in a secret store, instead of in the configuration. Use the secret label am.services.deviceid.encryption to map an alias for Device ID service secrets.

If AM finds a matching secret for the am.services.deviceid.encryption label in a secret store, this value is ignored.

Default value: /path/to/openam/security/keystores/keystore.jks

amster attribute: deviceIdSettingsEncryptionKeystore

Key Store Type

Type of key store to load.

PKCS#11 key stores require hardware support such as a security device or smart card and is not available by default in most JVM installations.

Learn more in the JDK 17 PKCS#11 Reference Guide.

If AM finds a matching secret for the am.services.deviceid.encryption label in a secret store, this value is ignored.

The possible values for this property are:

Label: Java Key Store (JKS) (value: JKS)
Label: Java Cryptography Extension Key Store (JCEKS) (value: JCEKS)
Label: PKCS#11 Hardware Crypto Storage (value: PKCS11)
Label: PKCS#12 Key Store (value: PKCS12)

Default value: JKS

amster attribute: deviceIdSettingsEncryptionKeystoreType

Key Store Password

Password to unlock the key store. AM encrypts this password when you save it in the configuration. You should modify the default value.

If AM finds a matching secret for the am.services.deviceid.encryption label in a secret store, this value is ignored.

amster attribute: deviceIdSettingsEncryptionKeystorePassword

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

If AM finds a matching secret for the am.services.deviceid.encryption label in a secret store, this value is ignored.

amster attribute: deviceIdSettingsEncryptionKeystoreKeyPairAlias

Private Key Password

Password to unlock the private key.

If AM finds a matching secret for the am.services.deviceid.encryption label in a secret store, this value is ignored.

amster attribute: deviceIdSettingsEncryptionKeystorePrivateKeyPassword

Device Profiles service

amster service name: DeviceProfilesService

Realm defaults

The following settings appear on the Realm Defaults tab:

Profile Storage Attribute

The user’s attribute in which to store Device profiles.

Default value: deviceProfiles

amster attribute: deviceProfilesAttrName

Device Profile Encryption Scheme

Encryption scheme to use to secure device profiles stored on the server.

The possible values for this property are:

Label: AES-256/HMAC-SHA-512 with RSA Key Wrapping (value: RSAES_AES256CBC_HS512)
Label: AES-128/HMAC-SHA-256 with RSA Key Wrapping (value: RSAES_AES128CBC_HS256)
Label: No encryption of device settings (value: NONE)

Default value: NONE

amster attribute: deviceProfilesSettingsEncryptionScheme

Encryption Key Store

Path to the key store from which to load encryption keys.

For greater security, store the encryption key information in a secret store, instead of in the configuration. Use the secret label am.services.deviceprofile.encryption to map an alias for Device Profiles service secrets.

If AM finds a matching secret for the am.services.deviceprofile.encryption label in a secret store, this value is ignored.

Default value: /path/to/openam/security/keystores/keystore.jks

amster attribute: deviceProfilesSettingsEncryptionKeystore

Key Store Type

Type of key store to load.

PKCS#11 key stores require hardware support such as a security device or smart card and is not available by default in most JVM installations.

Learn more in the JDK 17 PKCS#11 Reference Guide.

If AM finds a matching secret for the am.services.deviceprofile.encryption label in a secret store, this value is ignored.

The possible values for this property are:

Label: Java Key Store (JKS) (value: JKS)
Label: Java Cryptography Extension Key Store (JCEKS) (value: JCEKS)
Label: PKCS#11 Hardware Crypto Storage (value: PKCS11)
Label: PKCS#12 Key Store (value: PKCS12)

Default value: JKS

amster attribute: deviceProfilesSettingsEncryptionKeystoreType

Key Store Password

Password to unlock the key store. AM encrypts this password when you save it in the configuration. You should modify the default value.

If AM finds a matching secret for the am.services.deviceprofile.encryption label in a secret store, this value is ignored.

amster attribute: deviceProfilesSettingsEncryptionKeystorePassword

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

If AM finds a matching secret for the am.services.deviceprofile.encryption label in a secret store, this value is ignored.

amster attribute: deviceProfilesSettingsEncryptionKeystoreKeyPairAlias

Private Key Password

Password to unlock the private key.

If AM finds a matching secret for the am.services.deviceprofile.encryption label in a secret store, this value is ignored.

amster attribute: deviceProfilesSettingsEncryptionKeystorePrivateKeyPassword

Email service

The Email service supports AM’s user self-service feature. You can configure the email service globally or by realm. Learn more in Configure the email service.

amster service name: EmailService

Realm defaults

The following settings appear on the Realm Defaults tab:

Email From Address: The address from which to send self-service email notifications.

For example, you might set this property to: no-reply@example.com

For Microsoft Graph API transport configurations, this address must exist as a valid address in the Microsoft Exchange administration center.

amster attribute: from
Email Attribute Name: The profile attribute from which to retrieve the end user’s email address.

Default value: mail

amster attribute: emailAddressAttribute
Email Subject: A subject for notification messages. If you don’t set this, self-service emails won’t include a subject.

amster attribute: subject
Email Content: The content for notification messages. If you don’t set this, self-service emails include only the confirmation URL in the mail body.

amster attribute: message
Email Rate Limit: The minimum number of seconds that must elapse between sending emails to a specific user.

Default value: 1

amster attribute: emailRateLimitSeconds
Transport Type: The mail server transport type to use. This value must be set to one of the secondary configurations.

amster attribute: transportType

Secondary configurations

This service has the following secondary configurations.

Microsoft Graph API

Email Message Implementation Class: The class that sends email notifications, such as those sent for user registration and forgotten passwords.

Default value: org.forgerock.openam.services.email.rest.MicrosoftRestMailServer

amster attribute: emailImplClassName
Email Rest Endpoint URL: The REST endpoint for sending emails, in the format https://graph.microsoft.com/v1.0/users/USER ID/sendMail.

Learn more in the sendMail API reference.

amster attribute: emailEndpoint
OAuth2 Token Endpoint URL: The endpoint for OAuth 2.0 authentication, in the format https://login.microsoftonline.com/TENANT ID/oauth2/v2.0/token.

amster attribute: tokenEndpoint
OAuth2 Client Id: The client ID for use in OAuth 2.0 authentication.

This is the client ID or application ID provided by the Microsoft Application Registration portal.

amster attribute: clientId
OAuth2 Scopes: The scopes to request as part of the OAuth 2.0 authentication.

The value supported by Microsoft Graph API is https://graph.microsoft.com/.default.

amster attribute: scope

SMTP

Email Message Implementation Class

The class that sends email notifications, such as those sent for user registration and forgotten passwords.

Default value: org.forgerock.openam.services.email.MailServerImpl

amster attribute: emailImplClassName

Mail Server Host Name

The fully qualified domain name of the SMTP mail server through which to send self-service email notifications.

For example, you might set this property to: smtp.example.com

amster attribute: hostname

This is a different email server to the general mail server AM uses to send notification emails, for example, on account lockout.

Mail Server Host Port

The port number for the SMTP mail server.

Default value: 465

amster attribute: port

Mail Server Authentication Username

The username for the SMTP mail server.

For example, you might set this property to: username

amster attribute: username

Mail Server Authentication Password

The password for the SMTP user.

amster attribute: password

Mail Server Secure Connection

Whether to connect to the SMTP mail server using SSL.

The possible values for this property are:

SSL
Non SSL
Start TLS

Default value: SSL

amster attribute: sslState

External datastores

amster service name: DataStoreService

Realm defaults

The following settings appear on the Realm Defaults tab:

Policy Data Store

Select a datastore configuration to be used for policy storage

The possible values for this property are:

Label: Default Data Store (value: fd270e31-1788-4193-8734-eb2d500c47f3)

Default value: fd270e31-1788-4193-8734-eb2d500c47f3

amster attribute: policyDataStoreId

Application Data Store

Select a datastore configuration to be used for application storage

The possible values for this property are:

Label: Default Data Store (value: fd270e31-1788-4193-8734-eb2d500c47f3)

Default value: fd270e31-1788-4193-8734-eb2d500c47f3

amster attribute: applicationDataStoreId

Secondary configurations

This service has the following secondary configurations.

config

Host Urls: An ordered list of connection strings for LDAP directories.Each connection string is composed as follows: HOST:PORT. serverHostname = Host Name

amster attribute: serverUrls
Bind DN: amster attribute: bindDN
Bind Password: amster attribute: bindPassword
Minimum Connection Pool Size: Default value: 1

amster attribute: minimumConnectionPool
Maximum Connection Pool Size: Default value: 10

amster attribute: maximumConnectionPool
Use SSL: amster attribute: useSsl
Start TLS: amster attribute: useStartTLS
Affinity Enabled: amster attribute: affinityEnabled

ForgeRock Authenticator (OATH) service

amster service name: AuthenticatorOath

Realm defaults

The following settings appear on the Realm Defaults tab:

Profile Storage Attribute

Attribute for storing ForgeRock Authenticator OATH profiles.

The default attribute is added to the user store during AM installation. If you want to use a different attribute, you must make sure to add it to your user store schema prior to deploying two-step verification with a ForgeRock OATH authenticator app in AM. AM must be able to write to the attribute.

Default value: oathDeviceProfiles

amster attribute: oathAttrName

Device Profile Encryption Scheme

Encryption scheme for securing device profiles stored on the server.

The possible values for this property are:

Label: AES-256/HMAC-SHA-512 with RSA Key Wrapping (Value: RSAES_AES256CBC_HS512)
Label: AES-128/HMAC-SHA-256 with RSA Key Wrapping (Value: RSAES_AES128CBC_HS256)
Label: No encryption of device settings. (Value: NONE)

Default value: NONE

amster attribute: authenticatorOATHDeviceSettingsEncryptionScheme

Encryption Key Store

Path to the key store from which to load encryption keys.

For greater security, store the encryption key information in a secret store, instead of in the configuration. Use the secret label am.services.authenticatoroath.encryption to map an alias for ForgeRock Authenticator OATH service secrets.

If AM finds a matching secret for the am.services.authenticatoroath.encryption label in a secret store, this value is ignored.

Default value: /path/to/openam/openam/keystore.jks

amster attribute: authenticatorOATHDeviceSettingsEncryptionKeystore

Key Store Type

Type of encryption key store.

PKCS#11 keys tores require hardware support such as a security device or smart card and is not available by default in most JVM installations.

Learn more in the JDK 17 PKCS#11 Reference Guide.

If AM finds a matching secret for the am.services.authenticatoroath.encryption label in a secret store, this value is ignored.

The possible values for this property are:

Label: Java Key Store (JKS). (Value: JKS)
Label: Java Cryptography Extension Key Store (JCEKS). (Value: JCEKS)
Label: PKCS#11 Hardware Crypto Storage. (Value: PKCS11)
Label: PKCS#12 Key Store. (Value: PKCS12)

Default value: JKS

amster attribute: authenticatorOATHDeviceSettingsEncryptionKeystoreType

Key Store Password

Password to unlock the key store. AM encrypts this password when you save it in the configuration. You should modify the default value.

If AM finds a matching secret for the am.services.authenticatoroath.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorOATHDeviceSettingsEncryptionKeystorePassword

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

If AM finds a matching secret for the am.services.authenticatoroath.encryption label in a secret store, this value is ignored.

Default value: pushDeviceProfiles

amster attribute: authenticatorOATHDeviceSettingsEncryptionKeystoreKeyPairAlias

Private Key Password

Password to unlock the private key.

If AM finds a matching secret for the am.services.authenticatoroath.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorOATHDeviceSettingsEncryptionKeystorePrivateKeyPassword

ForgeRock Authenticator (OATH) Device Skippable Attribute Name

The datastore attribute that holds the user’s decision to enable or disable obtaining and providing a password obtained from the ForgeRock Authenticator app. This attribute must be writable.

Default value: oath2faEnabled

amster attribute: authenticatorOATHSkippableName

ForgeRock Authenticator (Push) service

amster service name: AuthenticatorPush

Realm defaults

The following settings appear on the Realm Defaults tab:

Profile Storage Attribute

The user’s attribute in which to store Push Notification profiles.

The default attribute is added to the schema when you prepare a user store for use with AM. If you want to use a different attribute, you must make sure to add it to your user store schema prior to deploying push notifications with the ForgeRock Authenticator app in AM. AM must be able to write to the attribute.

Default value: pushDeviceProfiles

amster attribute: pushAttrName

Device Profile Encryption Scheme

Encryption scheme to use to secure device profiles stored on the server.

The possible values for this property are:

Label: AES-256/HMAC-SHA-512 with RSA Key Wrapping (value: RSAES_AES256CBC_HS512)
Label: AES-128/HMAC-SHA-256 with RSA Key Wrapping (value: RSAES_AES128CBC_HS256)
Label: No encryption of device settings (value: NONE)

Default value: NONE

amster attribute: authenticatorPushDeviceSettingsEncryptionScheme

Encryption Key Store

Path to the key store from which to load encryption keys.

For greater security, store encryption key information in a secret store, instead of in the configuration. Use the secret label am.services.authenticatorpush.encryption to map an alias for ForgeRock Authenticator Push service secrets.

If AM finds a matching secret for the am.services.authenticatorpush.encryption label in a secret store, this value is ignored.

Default value: /path/to/openam/openam/keystore.jks

amster attribute: authenticatorPushDeviceSettingsEncryptionKeystore

Key Store Type

Type of key store to load.

PKCS#11 key stores require hardware support such as a security device or smart card and is not available by default in most JVM installations.

Learn more in the JDK 17 PKCS#11 Reference Guide.

If AM finds a matching secret for the am.services.authenticatorpush.encryption label in a secret store, this value is ignored.

The possible values for this property are:

Label: Java Key Store (JKS) (value: JKS)
Label: Java Cryptography Extension Key Store (JCEKS) (value: JCEKS)
Label: PKCS#11 Hardware Crypto Storage (value: PKCS11)
Label: PKCS#12 Key Store (value: PKCS12)

Default value: JKS

amster attribute: authenticatorPushDeviceSettingsEncryptionKeystoreType

Key Store Password

Password to unlock the key store. AM encrypts this password when you save it in the configuration. You should modify the default value.

If AM finds a matching secret for the am.services.authenticatorpush.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorPushDeviceSettingsEncryptionKeystorePassword

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

If AM finds a matching secret for the am.services.authenticatorpush.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorPushDeviceSettingsEncryptionKeystoreKeyPairAlias

Private Key Password

Password to unlock the private key.

If AM finds a matching secret for the am.services.authenticatorpush.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorPushDeviceSettingsEncryptionKeystorePrivateKeyPassword

ForgeRock Authenticator (Push) Device Skippable Attribute Name

The name of the attribute in a user’s profile used to store their decision on skipping push authentication.

Default value: push2faEnabled

amster attribute: authenticatorPushSkippableName

Globalization settings

amster service name: Globalization

Global attributes

The following settings appear on the Global Attributes tab:

Charsets Supported by Each Locale

This table lets you configure the order of supported character sets used for each supported locale. Change the settings only if the defaults are not appropriate.

Default value:

locale=zh|charset=UTF-8;GB2312
locale=ar|charset=UTF-8;ISO-8859-6
locale=es|charset=UTF-8;ISO-8859-15
locale=de|charset=UTF-8;ISO-8859-15
locale=zh_TW|charset=UTF-8;BIG5
locale=fr|charset=UTF-8;ISO-8859-15
locale=ko|charset=UTF-8;EUC-KR
locale=en|charset=UTF-8;ISO-8859-1
locale=th|charset=UTF-8;TIS-620
locale=ja|charset=UTF-8;Shift_JIS;EUC-JP

amster attribute: charsetMappings

Charset Aliases

Use this list to map between different character set names used in Java and in MIME.

Default value:

mimeName=EUC-KR|javaName=EUC_KR
mimeName=EUC-JP|javaName=EUC_JP
mimeName=Shift_JIS|javaName=SJIS

amster attribute: sun-identity-g11n-settings-charset-alias-mapping

Realm defaults

The following settings appear on the Realm Defaults tab:

Auto Generated Common Name Format: Use this list to configure how AM formats names shown in the console banner.

This setting allows the name of the authenticated user shown in the AM admin UI banner to be customised based on the locale of the user.

Default value: zh={sn}{givenname}

amster attribute: commonNameFormats

Google Cloud platform service accounts

amster service name: GoogleCloudServiceAccountService

Secondary configurations

This service has the following secondary configurations.

serviceAccounts

Credentials Secret Label: The secret label that contains the GCP service account credentials. Leave blank to use the default credentials from the environment. Credentials can be loaded from disk using a FileSystem Secret Store.

amster attribute: credentialsSecretId
Allowed Realms: A list of realms that can use this service account. Realms should be specified in path form, such as /subrealm/subsubrealm.

amster attribute: allowedRealms
Allowed Secret Names: A list of patterns of Google Secret Manager secret names that are allowed to be usedwith this service account. Patterns can include the wildcard "*".

Default value: *

amster attribute: allowedSecretNamePatterns
Disallowed Secret Names: A list of patterns of Google Secret Manager secret names that are not allowed to be used with this service account. Patterns can include the wildcard "*".

amster attribute: disallowedSecretNamePatterns

Http Client service

amster service name: HttpClientService

Realm defaults

The following settings appear on the Realm Defaults tab:

Enabled: Enable this Http Client service to use the secondary configurations when making HTTP requests.

If not enabled, HTTP requests use the default HTTP client handler configuration (org.forgerock.openam.httpclienthandler.system.*) set in advanced properties.

Default value: false

Secondary configurations

This service has the following secondary configurations.

Configure instances of the Http Client service to control how and which certificates AM uses in TLS connections.

You can use the Http Client service to send an HTTP request over mTLS from within a script.

Find out how to configure a service instance as the clientName for the httpClient script binding in Send a request using mTLS.

A secondary configuration instance has the following tabs:

Configuration

Enabled: Enable this Http Client instance.

TLS Configuration

Client Certificate Secret Label Identifier

AM uses this identifier to create a specific secret label, using the template am.services.httpclient.mtls.clientcert.identifier.secret where identifier is the value of Client Certificate Secret Label Identifier.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

If this field is empty, the Http Client service doesn’t attach a client certificate to HTTP requests that use mTLS to connect with a target server.

Server Trust Certificates Secret Label Identifier

AM uses this identifier to create a specific secret label, using the template am.services.httpclient.mtls.servertrustcerts.identifier.secret where identifier is the value of Server Trust Certificates Secret Label Identifier.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

If this field is empty, the system truststore is used when attempting to verify the target server’s certificate during a TLS connection.

Disable Certificate Revocation Check

If enabled, AM doesn’t check certificate revocation lists when performing a TLS connection with the target server.

Trust All Certificates

If enabled, AM trusts all certificates when performing a TLS connection with the target server.

Don’t enable this setting in a production environment. It’s intended for testing purposes only.

Timeouts

Use Instance Timeouts: If enabled, AM uses the connection and response timeouts defined in this Http Client service instance.
Connection Timeout (secs): The maximum time (in seconds) to wait for a connection to be established before failing.

Default value: 10
Response Timeout (secs): The maximum time (in seconds) to wait for a response from the target server before failing.

Default value: 10

Identity Assertion service

amster service name: IdentityAssertionService

Realm defaults

The following settings appear on the Realm Defaults tab:

Enable: Enables the Identity Assertion service that lets AM use PingGateway to manage authentication through a third party such as WDSSO or Kerberos.

When enabled, the servers defined in the secondary configuration become available as options in the Identity Assertion node configuration.

Default value: true
Server cache duration (minutes): Supports caching of identity assertion server configurations. A value greater than 0 indicates the duration in minutes that the server configurations are cached. A value of 0 disables caching.

Default value: 120

Secondary configurations

This service has the following secondary configurations.

Identity Assertion server URL: The identity assertion server URL, for example, https://ig.example.com:8448. Don’t include the route in this URL because you define the route when you configure the Identity Assertion node.
Shared Encryption Secret: AM uses this identifier to create a specific secret label, using the template am.services.identityassertion.service.identifier.shared.secret where identifier is the value of Shared Encryption Secret.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

The secret is shared by AM and PingGateway to encrypt the assertion request JWT sent to PingGateway and then decrypt the result JWT.

Learn about mapping secrets in Map and rotate secrets.
JWT TTL (seconds): The identity assertion request JWT time-to-live duration in seconds. This is the period until the JWT sent to the gateway expires.

Default value: 30
Skew Allowance (seconds): The time difference skew allowance to use when validating the assertion result JWT’s issued-at and expiry claims. This is to address time differences between the PingGateway host and the AM hosts.

Default value: 0

IDM Provisioning

amster service name: IDMProvisioning

The following settings are available in this service:

Enabled: Default value: false

amster attribute: enabled
Deployment URL: URL of the IDM deployment, for example, https://localhost:8080.

amster attribute: idmDeploymentUrl
Deployment Path: Path of the IDM deployment, for example, openidm.

amster attribute: idmDeploymentPath
IDM Provisioning Client: The name of the oauth client to be used for the client credentials flow.

amster attribute: idmProvisioningClient
Signing Key Alias: Alias of the signing symmetric key in AM’s default keystore. Must be a duplicate of the symmetric key used by IDM.

amster attribute: provisioningSigningKeyAlias
Encryption Key Alias: Alias of the encryption asymmetric key in AM’s default keystore. Must be a duplicate of the asymmetric key used by IDM.

amster attribute: provisioningEncryptionKeyAlias
Signing Algorithm: JWT signing algorithm.

amster attribute: provisioningSigningAlgorithm
Signing Compatibility Mode: This option was used only for compatibility with unsupported IDM versions and is no longer documented.

Default value: false

amster attribute: jwtSigningCompatibilityMode
Encryption Algorithm: JWT encryption algorithm.

amster attribute: provisioningEncryptionAlgorithm
Encryption Method: JWT encryption method.

amster attribute: provisioningEncryptionMethod

Configuration Cache Duration: Specify a duration in minutes for caching static IDM configuration to reduce calls to IDM endpoints and improve performance.

The following values are cached for the specified duration: IDM schemas, consent mappings, validation requirements, KBA configuration, and the IDM active terms.

If changes are made to the IDM Provisioning service in AM during this period, the configuration cache is immediately cleared. If, however, changes are made to IDM, the cache is only refreshed when the duration expires.

A zero value disables this feature.

Default value: 0

amster attribute: configurationCacheDuration

IoT service

amster service name: IoTService

Realm defaults

The following settings appear on the Realm Defaults tab:

Create OAuth 2.0 Client: Create an OAuth 2.0 Client with the given name and default configuration required to serve as the client for the IoT Service. The client will be created without any scope(s).

Default value: false

amster attribute: createOAuthClient
OAuth 2.0 Client Name: The name of the default OAuth 2.0 Client used by the IoT Service to request access tokens for things.

Default value: forgerock-iot-oauth2-client

amster attribute: oauthClientName
Create OAuth 2.0 JWT Issuer: Create a Trusted JWT Issuer with the given name and default configuration required for the IoT Service to act as the Issuer when handling request for thing access tokens.

Default value: false

amster attribute: createOAuthJwtIssuer
OAuth 2.0 JWT Issuer Name: The name of the Trusted JWT Issuer used by the IoT Service to request access tokens for things.

Default value: forgerock-iot-jwt-issuer

amster attribute: oauthJwtIssuerName
OAuth 2.0 Subject Attribute: The name of the identity store attribute from which to read the OAuth 2.0 subject value. The subject is used in access tokens issued for things. This allows the thing’s access token subject to have a value other than the thing’s ID, which is the value used by default.

amster attribute: oauthSubjectAttribute
Readable Attributes: Specifies the list of attributes that a thing is allowed to request from its identity.

Default value: thingConfig

amster attribute: attributeAllowlist

Legacy User Self-Service

amster service name: SecurityProperties

Realm defaults

The following settings appear on the Realm Defaults tab:

Legacy Self-Service REST Endpoint

Specify whether to enable the legacy self-service endpoint.

AM supports two user self-service components: the Legacy User Self-Service, which is based on a Java SDK and is available in AM versions prior to AM 13, and a common REST-based/XUI-based User Self-Service available in AM 13 and later.

The Legacy User Self-Service will be deprecated in a future release.

Default value: false

amster attribute: selfServiceEnabled

Self-Registration for Users

If enabled, new users can sign up using a REST API client.

Default value: false

amster attribute: selfRegistrationEnabled

Self-Registration Token LifeTime (seconds)

Maximum life time for the token allowing User Self-Registration using the REST API.

Default value: 900

amster attribute: selfRegistrationTokenLifetime

Self-Registration Confirmation Email URL

This page handles the HTTP GET request when the user clicks the link sent by email in the confirmation request.

Default value: http://openam.example.com:8080/openam/XUI/confirm.html

amster attribute: selfRegistrationConfirmationUrl

Forgot Password for Users

If enabled, users can assign themselves a new password using a REST API client.

Default value: false

amster attribute: forgotPasswordEnabled

Forgot Password Token Lifetime (seconds)

Maximum life time for the token that allows a user to process a forgotten password using the REST API.

Default value: 900

amster attribute: forgotPasswordTokenLifetime

Forgot Password Confirmation Email URL

This page handles the HTTP GET request when the user clicks the link sent by email in the confirmation request.

Default value: http://openam.example.com:8080/openam/XUI/confirm.html

amster attribute: forgotPasswordConfirmationUrl

Destination After Successful Self-Registration

Specifies the behavior when self-registration has successfully completed.

The possible values for this property are:

Label: User is sent to a 'successful registration' page, without being logged in (value: default)
Label: User is sent to the login page, to authenticate (value: login)
Label: User is automatically logged in and sent to the appropriate page within the system (value: autologin)

Default value: default

amster attribute: userRegisteredDestination

Protected User Attributes

A list of user profile attributes. Users modifying any of the attributes in this list will be required to enter a password as confirmation before the change is accepted. This option applies to XUI deployments only.

amster attribute: protectedUserAttributes

Confirmation Id HMAC Signing Key

256-bit key (base64-encoded) to use for HMAC signing of the legacy self-service confirmation email links.

Default value: Bn+TrDWLSv1E3ADHWxgqpv4fZnVmKLqwQcZvGdo/3jU=

amster attribute: confirmationIdHmacKey

Logging

amster service name: Logging

General

The following settings appear on the General tab:

Log Status

Enable the common REST-based audit logging service.

The possible values for this property are:

ACTIVE
INACTIVE

Default value: INACTIVE

amster attribute: status

Logging Type

Specifies whether to log to a database, Syslog, or to the file system.

If you choose database then be sure to set the connection attributes correctly, including the JDBC driver to use.

The possible values for this property are:

File
DB
Syslog

Default value: File

amster attribute: type

Configurable Log Fields

Controls the fields that are logged by AM.

This property is the list of fields that are logged by default. Administrators can choose to limit the information logged by AM.

Default value:

IPAddr
LoggedBy
LoginID
NameID
ModuleName
ContextID
Domain
LogLevel
HostName
MessageID

amster attribute: fields

Log Verification Frequency

The frequency (in seconds) that AM verifies security of the log files.

When secure logging is enabled, this is the period that AM will check the integrity of the log files.

Default value: 3600

amster attribute: verifyPeriod

Log Signature Time

The frequency (in seconds) that AM will digitally sign the log records.

When secure logging is enabled, this is the period that AM will digitally signed the contents of the log files. The log signatures form the basis of the log file integrity checking.

Default value: 900

amster attribute: signaturePeriod

Secure Logging

Enable or disable secure logging.

If this setting is enabled, AM digitally signs and verifies the contents of log files, to help prevent and detect log file tampering. You must configure a certificate for this functionality to be enabled.

The possible values for this property are:

ON
OFF

Default value: OFF

amster attribute: security

Secure Logging Signing Algorithm

Determines the algorithm used to digitally sign the log records.

The possible values for this property are:

MD2withRSA. MD2 with RSA
MD5withRSA. MD5 with RSA
SHA1withDSA. SHA1 with DSA
SHA1withRSA. SHA1 with RSA

Default value: SHA1withRSA

amster attribute: signingAlgorithm

Logging Certificate Store Location

The path to the Java keystore containing the logging system certificate.

The secure logging system will use the certificate alias of Logger to locate the certificate in the specified keystore.

Default value: %BASE_DIR%/var/audit/Logger.jks

amster attribute: certificateStore

Number of Files per Archive

Controls the number of logs files that will be archived by the secure logging system.

Default value: 5

amster attribute: filesPerKeystore

Buffer Size

The number of log records held in memory before the log records will be flushed to the logfile or the database.

Default value: 25

amster attribute: bufferSize

Buffer Time

The maximum time (in seconds) AM will hold log records in memory before flushing to the underlying repository.

Default value: 60

amster attribute: bufferTime

Time Buffering

Enable or disable log buffering

When enabled AM holds all log records in a memory buffer that it periodically flushes to the repository. The period is set in the Buffer Time property.

The possible values for this property are:

ON
OFF

Default value: ON

amster attribute: buffering

Logging Level

Control the level of JDK logging within AM.

The possible values for this property are:

OFF
SEVERE
WARNING
INFO
CONFIG
FINE
FINER
FINEST

Default value: INFO

amster attribute: jdkLoggingLevel

File

The following settings appear on the File tab:

Log Rotation

Enable log rotation to cause new log files to be created when configured thresholds are reached, such as Maximum Log Size or Logfile Rotation Interval.

Default value: true

amster attribute: rotationEnabled

Maximum Log Size

Maximum size of a log file, in bytes.

Default value: 100000000

amster attribute: maxFileSize

Number of History Files

Sets the number of history files for each log that AM keeps, including time-based histories.

The previously live file is moved and is included in the history count, and a new log is created to serve as the live log file. Any log file in the history count that goes over the number specified here will be deleted.

For time-based logs, a new set of logs will be created when AM is started because of the time-based file names that are used.

Default value: 1

amster attribute: numberHistoryFiles

Logfile Rotation Prefix

The name of the log files will be prefixed with the supplied value.

This field defines the log file prefix. The prefix will be added to the name of all logfiles.

Only used when time-based log rotation is enabled.

amster attribute: prefix

Logfile Rotation Suffix

The name of the log files will be suffixed with the supplied value.

This field defines the log file suffix. If no suffix is provided, the following default suffix format is used: -MM.dd .yy-kk.mm. The suffix allows the use of Date and Time patterns defined in SimpleDateFormat.

This field is only used if time-based rotation is enabled.

Default value: -MM.dd.yy-kk.mm

amster attribute: suffix

Logfile Rotation Interval

The rotation interval (in minutes).

The rotation interval determines the frequency of when the log files will be rotated. If the value is -1, then time-based rotation is disabled and log file size-based rotation is enabled.

Default value: -1

amster attribute: rotationInterval

Log File Location

The path to the location of the log files

This property controls the location of the log files. The value depends on whether File or DB logging is used:

File: The full pathname to the directory containing the log files.
DB: The JDBC URL to the database used to store the log file database.

Default value: %BASE_DIR%/var/audit/

amster attribute: location

Database

The following settings appear on the Database tab:

Database User Name: When logging to a database, set this to the username used to connect to the database. If this attribute is incorrectly set, AM performance suffers.

Default value: dbuser

amster attribute: user
Database User Password: When logging to a database, set this to the password used to connect to the database. If this attribute is incorrectly set, AM performance suffers.

amster attribute: password
Database Driver Name: When logging to a database, set this to the class name of the JDBC driver used to connect to the database.

The default is for Oracle. AM also works with the MySQL database driver.

Default value: oracle.jdbc.driver.OracleDriver

amster attribute: driver
Maximum Number of Records: The maximum number of records read from the logs through the logging API.

Default value: 500

amster attribute: maxRecords
DB Failure Memory Buffer Size: Max number of log records held in memory if DB logging fails.

This is the maximum number of log records that will be held in memory if the database is unavailable. When the buffer is full, new log records cause the oldest record in the buffer to be cleared. AM monitoring records the number of log entries cleared when the database was unavailable.

If the value of this property is less than that of the Buffer Size then the buffer size value will take precedence.

Default value: 2

amster attribute: databaseFailureMemoryBufferSize

Syslog

The following settings appear on the Syslog tab:

Syslog server host

The URL or IP address of the syslog server, for example http://mysyslog.example.com, or localhost.

Default value: localhost

amster attribute: host

Syslog server port

The port number the syslog server is configured to listen to.

Default value: 514

amster attribute: port

Syslog transport protocol

The protocol to use to connect to the syslog server.

The possible values for this property are:

UDP
TCP

Default value: UDP

amster attribute: protocol

Syslog facility

Syslog uses the facility level to determine the type of program that is logging the message.

The possible values for this property are:

kern
user
mail
daemon
auth
syslog
lpr
news
uucp
cron
authpriv
ftp
local0
local1
local2
local3
local4
local5
local6
local7

Default value: local5

amster attribute: facility

Syslog connection timeout

The period of time, in seconds, to wait when attempting to connect to the syslog server, before reporting a failure.

Default value: 30

amster attribute: timeout

Monitoring

amster service name: Monitoring

Configuration

The following settings appear on the Configuration tab:

Monitoring Status: Enable the monitoring system in AM.

Default value: false

amster attribute: enabled
Monitoring HTTP Port: Port number for the HTTP monitoring interface.

This attribute is deprecated.

Default value: 8082

amster attribute: httpPort
Monitoring HTTP interface status: Enable / Disable the HTTP access to the monitoring system.

This attribute is deprecated.

Default value: false

amster attribute: httpEnabled
Monitoring HTTP interface authentication file path: Path to the monitoring system authentication file

The openam_mon_auth file contains the username and password of the account used to protect the monitoring interfaces. The default username is demo with a password of changeit. Use the ampassword command to encrypt a new password.

This attribute is deprecated.

Default value: %BASE_DIR%/security/openam_mon_auth

amster attribute: authfilePath
Monitoring RMI Port: Port number for the JMX monitoring interface

This attribute is deprecated.

Default value: 9999

amster attribute: rmiPort
Monitoring RMI interface status: Enable / Disable the JMX access to the monitoring system

This attribute is deprecated.

Default value: false

amster attribute: rmiEnabled
Policy evaluation monitoring history size: Size of the window of most recent policy evaluations to record to expose via monitoring system. Valid range is 100 - 1000000.

This attribute is deprecated.

Default value: 10000

amster attribute: policyHistoryWindowSize
Session monitoring history size: Size of the window of most recent session operations to record to expose via monitoring system. Valid range is 100 - 1000000.

This attribute is deprecated.

Default value: 10000

amster attribute: sessionHistoryWindowSize

Secondary configurations

This service has the following secondary configurations.

crest

Enabled: Default value: false

amster attribute: enabled

graphite

Hostname: The hostname of the Graphite server to which metrics should be published.

amster attribute: host
Port: The port of the Graphite server to which metrics should be published.

Default value: 2004

amster attribute: port
Frequency: The frequency (in seconds) at which metrics should be published.

Default value: 30

amster attribute: frequency

prometheus

Enabled

Default value: false

amster attribute: enabled

Authentication Type

The type of authentication determines whether Prometheus needs to authenticate: None or HTTP Basic.

Default value: HTTP Basic

amster attribute: authenticationType

Username

If the authentication type is HTTP Basic, specify a username for Prometheus to use when accessing the endpoint.

Default value: prometheus

amster attribute: username

Password

If the authentication type is HTTP Basic, specify a password for Prometheus to use when accessing the endpoint.

If you set a Secret Label Identifier and AM finds a matching secret in a secret store, the Password is ignored.

amster attribute: password

Secret Label Identifier

AM uses this identifier to create a specific secret label, using the template am.services.monitoring.prometheus.identifier.secret where identifier is the value of Secret Label Identifier.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

If you set a Secret Label Identifier and AM finds a matching secret in a secret store, the Password is ignored.

amster attribute: password

Multi-federation protocol

amster service name: MultiFederationProtocol

The following settings are available in this service:

Single Logout Handler List

List of logout handlers for each supported federation protocol

The multi-federation protocol engine supports single logout. Each federation protocol requires a different single logout handler. The logout handler must implement the com.sun.identity.multiprotocol.SingleLogoutHandler interface.

Default value:

key=WSFED|class=com.sun.identity.multiprotocol.WSFederationSingleLogoutHandler
key=SAML2|class=com.sun.identity.multiprotocol.SAML2SingleLogoutHandler

amster attribute: singleLogoutHandlerList

Naming

amster service name: Naming

General configuration

The following settings appear on the General Configuration tab:

Profile Service URL: Specifies the endpoint used by the profile service.

This attribute is deprecated.

Default value: %protocol://%host:%port%uri/profileservice

amster attribute: profileUrl
Session Service URL: Specifies the endpoint used by the session service.

Default value: %protocol://%host:%port%uri/sessionservice

amster attribute: sessionUrl
Logging Service URL: Specifies the endpoint used by the logging service.

Default value: %protocol://%host:%port%uri/loggingservice

amster attribute: loggingUrl
Policy Service URL: Specifies the endpoint used by the policy service.

Default value: %protocol://%host:%port%uri/policyservice

amster attribute: policyUrl
Authentication Service URL: Specifies the endpoint used by the authentication service.

Default value: %protocol://%host:%port%uri/authservice

amster attribute: authUrl

Federation configuration

The following settings appear on the Federation Configuration tab:

SAML Web Profile/Artifact Service URL: Specifies the SAML v1 endpoint.

Default value: %protocol://%host:%port%uri/SAMLAwareServlet

amster attribute: samlAwareServletUrl
SAML SOAP Service URL: Specifies the SAML v1 SOAP service endpoint.

Default value: %protocol://%host:%port%uri/SAMLSOAPReceiver

amster attribute: samlSoapReceiverUrl
SAML Web Profile/POST Service URL: Specifies the SAML v1 Web Profile endpoint.

Default value: %protocol://%host:%port%uri/SAMLPOSTProfileServlet

amster attribute: samlPostServletUrl
SAML Assertion Manager Service URL: Specifies the SAML v1 assertion service endpoint.

Default value: %protocol://%host:%port%uri/AssertionManagerServlet/AssertionManagerIF

amster attribute: samlAssertionManagerUrl
JAXRPC Endpoint URL: (Deprecated) Specifies the JAXRPC endpoint URL used by the remote IDM/SMS APIs.

Default value: %protocol://%host:%port%uri/jaxrpc/

amster attribute: jaxrpcUrl

Endpoint configuration

The following settings appear on the Endpoint Configuration tab:

Identity Web Services Endpoint URL: Specifies the endpoint for the Identity WSDL services.

Default value: %protocol://%host:%port%uri/identityservices/

amster attribute: jaxwsUrl
Identity REST Services Endpoint URL: Specifies the endpoint for the Identity REST services.

Default value: %protocol://%host:%port%uri/identity/

amster attribute: idsvcsRestUrl
Security Token Service Endpoint URL: Specifies the STS endpoint.

Default value: %protocol://%host:%port%uri/sts

amster attribute: stsUrl
Security Token Service MEX Endpoint URL: Specifies the STS MEX endpoint.

Default value: %protocol://%host:%port%uri/sts/mex

amster attribute: stsMexUrl

OAuth2 provider

amster service name: OAuth2Provider

Global attributes

The following settings appear on the Global Attributes tab:

Token Denylist Cache Size

Number of denylisted tokens to cache in memory to speed up denylist checks and reduce load on the CTS.

Default value: 10000

amster attribute: blacklistCacheSize

Denylist Poll Interval (seconds)

How frequently to poll for token denylist changes from other servers, in seconds.

How often each server will poll the CTS for token denylist changes from other servers. This is used to maintain a highly compressed view of the overall current token denylist improving performance. A lower number will reduce the delay for denylisted tokens to propagate to all servers at the cost of increased CTS load. Set to 0 to disable this feature completely.

Default value: 10

amster attribute: blacklistPollInterval

Denylist Purge Delay (minutes)

Length of time to denylist tokens beyond their expiry time.

Allows additional time to account for clock skew to ensure that a token has expired before it is removed from the denylist.

Default value: 1

amster attribute: blacklistPurgeDelay

Client-Side Grant Token Upgrade Compatibility Mode

Enable AM to consume and create client-side OAuth 2.0 tokens in two different formats simultaneously.

Enable this option when upgrading AM to allow the new instance to create and consume client-side OAuth 2.0 tokens in both the previous format and the new format. Disable this option once all AM instances in the cluster have been upgraded.

Default value: false

amster attribute: statelessGrantTokenUpgradeCompatibilityMode

CTS Storage Scheme

Storage scheme to be used when storing OAuth 2.0 tokens to CTS.

To support rolling upgrades, this should be set to the latest storage scheme supported by all AM instances within your cluster. Select the latest storage scheme once all AM instances in the cluster have been upgraded.

The storage scheme can be one of the following:

One-to-One Storage Scheme

Under this storage scheme, each OAuth 2.0 token maps to an individual CTS entry.

This storage scheme is inefficient - use the Grant-Set Storage Scheme after all servers have been upgraded to a version that supports it.

(Amster value: CTS_ONE_TO_ONE_MODEL)
Grant-Set Storage Scheme

Under this storage scheme, multiple authorization codes, access tokens, and refresh tokens for a given OAuth 2.0 client and resource owner can be stored within a single CTS entry.

(Amster value: CTS_GRANT_SET_MODEL)

Default value: One-to-One Storage Scheme

amster attribute: storageScheme

Enforce JWT Unreasonable Lifetime

Enable the enforcement of JWT token unreasonable lifetime during validation.

The JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants specification states that an authorization server can reject JWTs with an "exp" claim value that is unreasonably far in the future and an "iat" claim value that is unreasonably far in the past. This enforcement can be disabled, but should only be done if the security implications have been evaluated.

Default value: true

amster attribute: jwtTokenLifetimeValidationEnabled

JWT Unreasonable Lifetime (seconds)

Specify the lifetime (in seconds) of a JWT which should be considered unreasonable and rejected by validation.

The JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants specification states that an authorization server can reject JWTs with an "exp" claim value that is unreasonably far in the future and an "iat" claim value that is unreasonably far in the past. During token validation AM enforces that the token must expire within the specified duration and if the "iat" claim value is present, the token must not be older than the specified duration.

Default value: 86400

amster attribute: jwtTokenUnreasonableLifetime

JWT Required Claims

Specify a custom list of claims that will be treated as required during validation of an OAuth 2.0 authorization grant or client authentication JWT. This is in addition to the default mandatory claims, "iss", "aud", and "exp". AM will throw an error if any of the claims defined in this attribute are not present.

This attribute does not apply to a request object JWT, such as the JWT parameter used when invoking the PAR endpoint.

Default value: [Empty]

amster attribute: jwtTokenRequiredClaims

OAuth2 allow unauthenticated user code entry

Determines whether authentication must take place before a user is permitted to proceed to the verification URL to enter a user code.

If set to true, users will be able to input a user code without first signing on.

This setting is intended for backwards compatibility purposes only and should only be enabled on existing installations that require legacy functionality.

Default value: false

amster attribute: allowUnauthorisedAccessToUserCodeForm

Core

The following settings appear on the Core tab:

Use Client-Side Access & Refresh Tokens

When enabled, AM issues access and refresh tokens that can be inspected by resource servers.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: false

amster attribute: statelessTokensEnabled

Use Macaroon Access and Refresh Tokens

When enabled, AM will issue access and refresh tokens as Macaroons with caveats.

Default value: false

amster attribute: macaroonTokensEnabled

Authorization Code Lifetime (seconds)

The time an authorization code is valid for, in seconds.

Default value: 120

amster attribute: codeLifetime

Refresh Token Lifetime (seconds)

The time in seconds a refresh token is valid for. If this field is set to -1, the refresh token will never expire.

Default value: 604800

amster attribute: refreshTokenLifetime

Access Token Lifetime (seconds)

The time an access token is valid for, in seconds. Note that if you set the value to 0, the access token will not be valid. A maximum lifetime of 600 seconds is recommended.

Default value: 3600

amster attribute: accessTokenLifetime

Issue Refresh Tokens

Whether to issue a refresh token when returning an access token.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: true

amster attribute: issueRefreshToken

Issue Refresh Tokens on Refreshing Access Tokens

Whether to issue a refresh token when refreshing an access token.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: true

amster attribute: issueRefreshTokenOnRefreshedToken

Use Policy Engine for Scope decisions

With this setting enabled, the policy engine is consulted for each scope value that is requested.

Scope decisions are made in the following way when based on the policy engine:

If a policy returns an action of GRANT=true, the scope is consented automatically, and the user is not consulted in a user-interaction flow.
If a policy returns an action of GRANT=false, the scope is not added to any resulting token, and the user will not see it in a user-interaction flow.
If no policy returns a value for the GRANT action:
- For user-facing grant types, such as the authorization or device code flows, the user is asked for consent or saved consent is used.
- For grant types that are not user-facing, such as those using password or client credentials, the scope is not added to any resulting token.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: false

amster attribute: usePolicyEngineForScope

Scopes Policy Set

The policy set that defines the context in which policy evaluations occur when Use Policy Engine for Scope decisions is enabled on the OAuth 2.0 provider. Leave this field blank, or set it to oauth2Scopes to use the default policy set.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: [Empty]

OAuth2 Access Token May Act Script

The script that is executed when issuing an access token explicitly to modify the may_act claim placed on the token.

This setting can be overridden at the client level. Learn more in client profile configuration.

The possible values for this property are:

Label: OAuth2 May Act Script (Value: c735de08-f8f2-4e69-aa4a-2d8d3d438323)
Label: --- Select a script --- (Value: [Empty])

Default value: [Empty]

amster attribute: accessTokenMayActScript

OIDC ID Token May Act Script

The script that is executed when issuing an OIDC ID Token explicitly to modify the may_act claim placed on the token.

This setting can be overridden at the client level. Learn more in client profile configuration.

The possible values for this property are:

Label: OAuth2 May Act Script (Value: c735de08-f8f2-4e69-aa4a-2d8d3d438323)
Label: --- Select a script --- (Value: [Empty])

Default value: [Empty]

amster attribute: oidcMayActScript

Advanced

The following settings appear on the Advanced tab:

Custom Login URL Template

Custom URL for handling login, to override the default AM login page.

Supports Freemarker syntax, with the following variables:

Variable

Description

gotoUrl

The URL to redirect to after login.

acrValues

The Authentication Context Class Reference (acr) values for the authorization request.

realm

The AM realm the authorization request was made on.

service

The name of the authentication tree requested to perform resource owner authentication.

locale

A space-separated list of locales, ordered by preference.

The following example template redirects users to a non-AM front end to handle login, which will then redirect back to the /oauth2/authorize endpoint with any required parameters:

http://mylogin.com/login?goto=${goto}<#if acrValues??>&acr_values=${acrValues}</#if><#if realm??>&realm=${realm}</#if><#if service??>&service=${service}</#if><#if locale??>&locale=${locale}</#if>

The default AM login page is constructed using the "Base URL Source" service.

This setting can be overridden at the client level. Learn more in client profile configuration.

amster attribute: customLoginUrlTemplate

Persistent Claims

Set of custom claims that can be persisted between token refreshes. This list should not include the RFC 123 OAuth2 specification defined list of claims.

Default value:

amster attribute: persistentClaims

Response Type Plugins

List of plugins that handle the valid response_type values.

OAuth 2.0 clients pass response types as parameters to the OAuth 2.0 Authorization endpoint (/oauth2/authorize) to indicate which grant type is requested from the provider. For example, the client passes code when requesting an authorization code, and token when requesting an access token.

Values in this list take the form response-type|plugin-class-name.

Default value:

code|org.forgerock.oauth2.core.AuthorizationCodeResponseTypeHandler
id_token|org.forgerock.openidconnect.IdTokenResponseTypeHandler
device_code|org.forgerock.oauth2.core.TokenResponseTypeHandler
token|org.forgerock.oauth2.core.TokenResponseTypeHandler

amster attribute: responseTypeClasses

Additional Audience Values

The additional audience values that will be permitted when verifying Client Authentication JWTs.

These audience values will be in addition to the AS base, issuer and endpoint URIs.

amster attribute: allowedAudienceValues

Token Exchanger Plugins

List of plugins that handle the valid requested_token_type values.

When using the Token Exchange grant type, these handlers will be used to convert the provided subject_token and actor_token into the appropriate impersonation or delegation tokens for use with downstream services.

Default value:

urn:ietf:params:oauth:token-type:access_token=&gt;urn:ietf:params:oauth:token-type:access_token|org.forgerock.oauth2.core.tokenexchange.accesstoken.AccessTokenToAccessTokenExchanger
urn:ietf:params:oauth:token-type:id_token=&gt;urn:ietf:params:oauth:token-type:id_token|org.forgerock.oauth2.core.tokenexchange.idtoken.IdTokenToIdTokenExchanger
urn:ietf:params:oauth:token-type:access_token=&gt;urn:ietf:params:oauth:token-type:id_token|org.forgerock.oauth2.core.tokenexchange.accesstoken.AccessTokenToIdTokenExchanger
urn:ietf:params:oauth:token-type:id_token=&gt;urn:ietf:params:oauth:token-type:access_token|org.forgerock.oauth2.core.tokenexchange.idtoken.IdTokenToAccessTokenExchanger

amster attribute: tokenExchangeClasses

Token Validator Plugins

List of plugins that validate subject_token and actor_token values.

When using the Token Exchange grant type, these handlers will be used to convert the validate subject_token and actor_token values to ensure they meet the required criteria to be exchanged.

Default value:

urn:ietf:params:oauth:token-type:id_token|org.forgerock.oauth2.core.tokenexchange.idtoken.OidcIdTokenValidator
urn:ietf:params:oauth:token-type:access_token|org.forgerock.oauth2.core.tokenexchange.accesstoken.OAuth2AccessTokenValidator

amster attribute: tokenValidatorClasses

User Profile Attribute(s) the Resource Owner is Authenticated On

Names of profile attributes that resource owners use to log in. You can add others to the default, for example mail.

Default value: uid

amster attribute: authenticationAttributes

User Display Name attribute

The profile attribute that contains the name to be displayed for the user on the consent page.

Default value: cn

amster attribute: displayNameAttribute

Client Registration Scope Allowlist

The set of scopes allowed when registering clients dynamically, with translations.

Scopes can be entered as simple strings or pipe-separated strings representing the internal scope name, locale, and localized description.

For example: read|en|Permission to view email messages in your account

Locale strings are in the format: language_country_variant, for example en, en_GB, or en_US_WIN.

If the locale and pipe is omitted, the description is displayed to all users that have undefined locales.

If the description is also omitted, nothing is displayed on the consent page for the scope. For example, specifying read| would allow the scope read to be used by the client but would not display it to the user on the consent page when requested.

amster attribute: supportedScopes

Subject Types supported

List of subject types supported. Valid values are:

public - Each client receives the same subject (sub) value.
pairwise - Each client receives a different subject (sub) value, to prevent correlation between clients.

Default value:
```
public
pairwise
```
amster attribute: supportedSubjectTypes

Default Client Scopes

List of scopes a client will be granted if they request registration without specifying which scopes they want. Default scopes are not auto-granted to clients created through the AM admin UI.

amster attribute: defaultScopes

OAuth2 Token Signing Algorithm

Algorithm used to sign client-side OAuth 2.0 tokens in order to detect tampering.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.

The possible values for this property are:
HS256
HS384
HS512
RS256
RS384
RS512
ES256
ES384
ES512
PS256
PS384
PS512

Default value: HS256
amster attribute: tokenSigningAlgorithm

Client-Side Token Compression

Whether client-side access and refresh tokens should be compressed.

Default value: false

amster attribute: tokenCompressionEnabled

Encrypt Client-Side Tokens

Whether client-side access and refresh tokens should be encrypted.

Enabling token encryption will disable token signing as encryption is performed using direct symmetric encryption.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: false

amster attribute: tokenEncryptionEnabled

Subject Identifier Hash Salt

If pairwise subject types are supported, it is STRONGLY RECOMMENDED to change this value. It is used in the salting of hashes for returning specific sub claims to individuals using the same request_uri or sector_identifier_uri.

If you map am.services.oauth2.provider.hash.salt.secret to a secret in a secret store, AM ignores this value.

Learn more about secret labels in OAuth 2.0 default secret label mappings.

Default value: changeme

amster attribute: hashSalt

Code Verifier Parameter Required

If enabled, requests using the authorization code grant or device flow require a code_challenge attribute to comply with the PKCE standard.

For more information, read the PKCE specification.

Note that if a client specifies a code_challenge parameter in the authorization request, PKCE is enabled regardless of the value of this attribute.

The possible values for this property are:

Label: All requests (Value: true)
Label: Requests from all public clients (Value: public)
Label: Requests from all passwordless public clients (Value: passwordless)
Label: No requests (Value: false)

Default value: false

amster attribute: codeVerifierEnforced

Modified Timestamp Attribute Name

The identity Data Store attribute used to return modified timestamp values.

This attribute is paired together with the Created Timestamp Attribute Name attribute (createdTimestampAttribute). You can leave both attributes unset (default) or set them both. If you set only one attribute and leave the other blank, the access token fails with a 500 error.

For example, when you configure AM as an OIDC provider (OP) in a Mobile Connect application and use DS as an identity store, the client accesses the userinfo endpoint to obtain the updated_at claim value in the ID token. The updated_at claim gets its value from the modifiedTimestampAttribute attribute in the user profile. If the profile has never been modified the updated_at claim uses the createdTimestampAttribute attribute.

amster attribute: modifiedTimestampAttribute

Created Timestamp Attribute Name

The identity Data Store attribute used to return created timestamp values.

amster attribute: createdTimestampAttribute

Password Grant Authentication Service

The tree used to authenticate the username and password for the resource owner password credentials grant type.

amster attribute: passwordGrantAuthService

Enable Auth Module Messages for Password Credentials Grant

This property was used only for authentication with modules and chains and is no longer documented.

Grant Types

The set of Grant Types (OAuth 2.0 flows) that are permitted to be used by this client.

If no Grant Types (OAuth 2.0 Flows) are configured, nothing is permitted.

Default value:

implicit
urn:ietf:params:oauth:grant-type:saml2-bearer
refresh_token
password
client_credentials
urn:ietf:params:oauth:grant-type:device_code
authorization_code
urn:openid:params:grant-type:ciba
urn:ietf:params:oauth:grant-type:uma-ticket
urn:ietf:params:oauth:grant-type:token-exchange
urn:ietf:params:oauth:grant-type:jwt-bearer

amster attribute: grantTypes

Trusted TLS Client Certificate Header

HTTP Header to receive TLS client certificates when TLS is terminated at a proxy.

Leave blank if not terminating TLS at a proxy. Ensure that the proxy is configured to strip this headerfrom incoming requests. Best practice is to use a random string.

amster attribute: tlsClientCertificateTrustedHeader

TLS Client Certificate Header Format

Format of the HTTP header used to communicate a client certificate from a reverse proxy.

The following formats are supported:

BASE64_ENCODED_CERT: For Base64-encoded, URL-encoded certificates in PEM or DER format.

AM infers the certificate type from the contents of the certificate. For example, a certificate that starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE----- is inferred to be a PEM format certificate. A certificate that starts and ends with a colon (:) is inferred to be a DER format certificate.

NGINX, Google GKE, and AWS provide certificates in this format.
X_FORWARDED_CLIENT_CERT: The proxy provides the certificate in the X-Forwarded-Client-Cert header.

Istio/Envoy proxies provide certificates in this way. Find more information in the Envoy documentation.

Default value: BASE64_ENCODED_CERT
amster attribute: tlsClientCertificateHeaderFormat

Support TLS Certificate-Bound Access Tokens

Whether to bind access tokens to the client certificate when using TLS client certificate authentication.

Default value: true

amster attribute: tlsCertificateBoundAccessTokensEnabled

Check TLS Certificate Revocation Status

Whether to check if TLS client certificates have been revoked.

If enabled then AM will check if TLS client certificates used for client authentication have been revoked using either OCSP (preferred) or CRL. AM implements "soft fail" semantics: if the revocation status cannot be established due to a temporary error (for example, a network error) then the certificate is assumed to still be valid.

Default value: false

amster attribute: tlsCertificateRevocationCheckingEnabled

OCSP Responder URI

URI of the OCSP responder service to use for checking certificate revocation status.

If specified this value overrides any OCSP or CRL mechanisms specified in individual certificates.

amster attribute: tlsOcspResponderUri

OCSP Responder Certificate

PEM-encoded certificate to use to verify OCSP responses.

If specified this certificate will be used to verify the signature on all OCSP responses. Otherwise the appropriate certificate will be determined from the trusted CA certificates.

amster attribute: tlsOcspResponderCert

Macaroon Token Format

The format to use when serializing and parsing Macaroons. V1 is bulky and should only be used when compatibility with older Macaroon libraries is required.

The possible values for this property are:

V1
V2

Default value: V2
amster attribute: macaroonTokenFormat

Require exp claim in Request Object

If enabled, the exp claim must be included in JWT request objects specified at /oauth2/authorize or /oauth2/par.

The exp (expiration time) claim defines the lifetime of the JWT, after which the JWT is no longer valid.

To comply with the FAPI security profile, this setting must be enabled.

Default value: false

amster attribute: expClaimRequiredInRequestObject

Require nbf claim in Request Object

If enabled, the nbf claim must be included in JWT request objects specified at /oauth2/authorize or /oauth2/par.

The nbf (not before) claim defines the earliest time that the JWT can be accepted for processing.

To comply with the FAPI security profile, this setting must be enabled.

Default value: false

amster attribute: nbfClaimRequiredInRequestObject

Max nbf and exp difference

The maximum permitted difference, in minutes, between the nbf and exp claims, as defined in the request object JWT.

A value of 0 indicates that there is no maximum time requirement.

If set to a value greater than 0, and either nbf or exp is not defined, the JWT is validated successfully, providing the claims are not required.

If set to a value greater than 0, and both claims are present, the JWT is validated accordingly, even when not required.

To comply with the FAPI security profile, this setting must be 60 (minutes) or less.

Default value: 0

amster attribute: maxDifferenceBetweenRequestObjectNbfAndExp

Max nbf age

The maximum permitted age, in minutes, of the nbf claim.

A value of 0 indicates that there is no maximum time requirement.

If set to a value greater than 0, and nbf is neither required nor specified, the JWT is validated successfully.

If set to a value greater than 0, and nbf is present, the JWT is validated accordingly, even when not required.

To comply with the FAPI security profile, this setting must be 60 (minutes) or less.

Default value: 0

amster attribute: maxAgeOfRequestObjectNbfClaim

Request Object Processing Specification

For OIDC requests only, this setting determines which specification is used to validate request object JWTs.

For example, the following OIDC request specifies a request object JWT and could be validated either according to the JAR specification, or as a standard OIDC request:

/authorize?client_id=myClient&request={JWT with scope=openid, response_type=id_token}

OAuth 2.0 requests that do not fall into this category, such as PAR or non-OIDC JWT requests, are processed according to the JAR specification, regardless of the value of this setting.

The possible values are:

OIDC - to adhere to the OIDC specification for JWT processing
JAR - to adhere to the JAR specification for JWT processing

This table summarizes the differences between the rules that need to be adhered to in each case.

Specification Rules
	OIDC specification	JAR specification
Request object	May be unsigned.	Must be JWS signed, and optionally, JWE encrypted.
Authorization request parameters	Assembles parameters from both the request object and the query parameters. If duplicates exist, the request object parameter takes precedence.	Assembles parameters from the request object ONLY. Duplicates that are defined as query parameters are ignored.
Required request parameters	`client_id` `response_type` `scope`, including `openid` scope value	`client_id` (must match the client ID specified in the request itself) `request` OR `request_uri`

Default value: OIDC

amster attribute: requestObjectProcessing

PAR Request URI Lifetime (seconds)

The length of time that the PAR Request URI is valid, in seconds.

Set this value to a short interval (for example, between 5 and 150 seconds). Setting this attribute to a higher value increases the load on the CTS, and can even result in denial of service if the requests are large and consume the available storage capacity.

Learn more about the PAR flow in Authorization code grant with PAR.

Default value: 90

amster attribute: parRequestUriLifetime

Require Pushed Authorization Requests

If enabled, clients must use the PAR endpoint to initiate authorization requests, otherwise AM will throw an error indicating a missing or invalid request object.

This applies to all clients, including clients that are not configured to require PAR. You can find details in Advanced client properties.

Default value: false

amster attribute: requirePushedAuthorizationRequests

Refresh Token Grace Period (seconds)

The time, in seconds, that a refresh token can be reused. This grace period lets OAuth 2.0 clients recover seamlessly if the response from an original refresh token request is not received because of a network problem or other transient issue. During the grace period, the refresh token can be reused multiple times if the network problem persists. When the grace period ends, the refresh token is revoked.

The refresh token grace period applies only to tokens in a one-to-one storage scheme.

Having a long grace period poses a security risk. You should therefore keep the grace period as small as possible. By default, the grace period cannot exceed 120 seconds. You can override this default maximum by setting the org.forgerock.openam.oauth2.client.graceperiod.disabled advanced server property. Note, however, that exceeding the default maximum of 120 seconds is not recommended.

There is no grace period by default, so the default value is 0.

Allow Client Credentials in Token Endpoint Query Parameters

When this setting is true, you can include client credentials in token endpoint requests as query parameters.

Default value: false

Don’t change this setting, for security reasons.

amster attribute: allowClientCredentialsInTokenRequestQueryParameters

Include subname claim in tokens issued by the OAuth2 Provider: When this setting is true, AM adds the subname claim to access and ID tokens by default.

The value of the subname claim is the name of the token’s subject, for example, bjensen, or myOAuth2Client.

Default value: true

Client Dynamic Registration

The following settings appear on the Client Dynamic Registration tab:

Require Software Statement for Dynamic Client Registration: When enabled, a software statement JWT containing at least the iss (issuer) claim must be provided when registering an OAuth 2.0 client dynamically.

Default value: false

amster attribute: dynamicClientRegistrationSoftwareStatementRequired
Required Software Statement Attested Attributes: The client attributes that are required to be present in the software statement JWT when registering an OAuth 2.0 client dynamically. Only applies if Require Software Statements for Dynamic Client Registration is enabled.

Leave blank to allow any attributes to be present.

Default value: redirect_uris

amster attribute: requiredSoftwareStatementAttestedAttributes
Allow Open Dynamic Client Registration: Allow clients to register without an access token. If enabled, consider adding some form of rate limiting. For details, refer to Client Registration in the OIDC specification.

Default value: false

amster attribute: allowDynamicRegistration
Generate Registration Access Tokens: Whether to generate Registration Access Tokens for clients that register by using open dynamic client registration. Such tokens let the client access the Client Configuration Endpoint as per the OIDC specification. This setting has no effect if Allow Open Dynamic Client Registration is disabled.

Default value: true

amster attribute: generateRegistrationAccessTokens
Scope to give access to dynamic client registration: Mandatory scope required when registering a new OAuth 2.0 client.

Default value: dynamic_client_registration

amster attribute: dynamicClientRegistrationScope
Dynamic Client Registration Script: Provide a script to customize dynamic client registration after a successful create, update, or delete operation.

Default value: --- Select a script ---

amster attribute: dynamicClientRegistrationScript

OpenID Connect

The following settings appear on the OpenID Connect tab:

Overrideable Id_Token Claims

List of claims in the ID token that can be overridden in the OIDC Claims script. These should be the subset of the core OIDC claims, such as aud or azp.

Learn more about the core OIDC claims in ID Token data structure.
You can find details about the OIDC script and how to implement a custom scripted plugin in OIDC user info claims.

To override claims, follow the steps described in Override the audience and issuer claims.

This setting can be overridden at the client level. Learn more in client profile configuration.

amster attribute: overrideableOIDCClaims

ID Token Signing Algorithms supported

Algorithms supported to sign OIDC id_tokens.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.
RS384 - RSASSA-PKCS-v1_5 using SHA-384.
RS512 - RSASSA-PKCS-v1_5 using SHA-512.
PS256 - RSASSA-PSS using SHA-256.
PS384 - RSASSA-PSS using SHA-384.

PS512 - RSASSA-PSS using SHA-512.

Default value:

PS384
ES384
RS384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512

amster attribute: supportedIDTokenSigningAlgorithms

ID Token Encryption Algorithms supported

Encryption algorithms supported to encrypt OIDC ID tokens to hide their contents.

AM supports the following ID token encryption algorithms:

RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
` RSA-OAEP-256` - RSA with OAEP with SHA-256 and MGF-1.
` A128KW` - AES Key Wrapping with 128-bit key derived from the client secret.
` RSA1_5` - RSA with PKCS#1 v1.5 padding.
` A256KW` - AES Key Wrapping with 256-bit key derived from the client secret.
` dir` - Direct encryption with AES using the hashed client secret.
` A192KW` - AES Key Wrapping with 192-bit key derived from the client secret.

Default value:
```
ECDH-ES+A256KW
ECDH-ES+A192KW
RSA-OAEP
ECDH-ES+A128KW
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW
```
amster attribute: supportedIDTokenEncryptionAlgorithms

ID Token Encryption Methods supported

Encryption methods supported to encrypt OIDC ID tokens to hide their contents.

AM supports the following ID token encryption algorithms:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:
```
A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512
```
amster attribute: supportedIDTokenEncryptionMethods

Supported Claims

Set of claims supported by the OIDC /oauth2/userinfo endpoint, with translations.

Claims can be entered as simple strings or pipe separated strings representing the internal claim name, locale, and localized description.

For example: name|en|Your full name..

Locale strings are in the format: language + "" + country + "" + variant, for example en, en_GB, or en_US_WIN. If the locale and pipe is omitted, the description is displayed to all users that have undefined locales.

If the description is also omitted, nothing is displayed on the consent page for the claim. For example specifying family_name| would allow the claim family_name to be used by the client, but would not display it to the user on the consent page when requested.

amster attribute: supportedClaims

OpenID Connect JWT Token Lifetime (seconds)

The period of time the JWT is valid, in seconds.

Default value: 3600

Don’t set a token lifetime greater than 86400 seconds (one day).

amster attribute: jwtTokenLifetime

OIDC Provider Discovery

Turns on and off OIDC Discovery endpoint.

Default value: false

amster attribute: oidcDiscoveryEndpointEnabled

Advanced OpenID Connect

The following settings appear on the Advanced OpenID Connect tab:

Remote JSON Web Key URL

The Remote URL where the providers JSON Web Key can be retrieved.

If this setting is not configured, then AM provides a local URL to access the public key of the private key used to sign ID tokens.

amster attribute: jkwsURI

Idtokeninfo Endpoint Requires Client Authentication

When enabled, the /oauth2/idtokeninfo endpoint requires client authentication if the signing algorithm is set to HS256, HS384, or HS512.

Default value: true

amster attribute: idTokenInfoClientAuthenticationEnabled

Enable "claims_parameter_supported"

If enabled, clients will be able to request individual claims using the claims request parameter, as per section 5.5 of the OIDC specification.

Default value: false

amster attribute: claimsParameterSupported

OpenID Connect acr_values to Auth Chain Mapping

Maps OIDC ACR values to authentication trees. You can find details in the acr_values parameter in the OIDC authentication request specification.

Don’t configure more than one ACR mapping to the same authentication tree. Doing so can result in misrepresentation of the ACR information in the issued ID token.

amster attribute: loaMapping

Default ACR values

Default requested Authentication Context Class Reference values.

List of strings that specifies the default acr values that the OP is being requested to use for processing requests from this Client, with the values appearing in order of preference. The Authentication Context Class satisfied by the authentication performed is returned as the acr Claim Value in the issued ID Token. The acr Claim is requested as a Voluntary Claim by this parameter. The acr_values_supported discovery element contains a list of the acr values supported by this server. Values specified in the acr_values request parameter or an individual acr Claim request override these default values.

amster attribute: defaultACR

OpenID Connect id_token amr Values to Auth Module Mappings

This property was used only for authentication with modules and chains and is no longer documented.

Always Return Claims in ID Tokens

If enabled, include scope-derived claims in the id_token, even if an access token is also returned that could provide access to get the claims from the userinfo endpoint.

If not enabled, if an access token is requested the client must use it to access the userinfo endpoint for scope-derived claims, as they will not be included in the ID token.

Default value: false

amster attribute: alwaysAddClaimsToToken

Enable Session Management

If this setting is disabled, OIDC session management related endpoints are disabled. When enabled AM stores ops tokens corresponding to OIDC sessions in the CTS store and an OIDC session ID in the AM session.

Default value: true

amster attribute: storeOpsTokens

Request Parameter Signing Algorithms Supported

Algorithms supported to verify signature of Request parameter. AM supports the signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.

Default value:

PS384
ES384
RS384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512

amster attribute: supportedRequestParameterSigningAlgorithms

Request Parameter Encryption Algorithms Supported

Encryption algorithms supported to decrypt Request parameter.

AM supports the following ID token encryption algorithms:

RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
RSA-OAEP-256 - RSA with OAEP with SHA-256 and MGF-1.
A128KW - AES Key Wrapping with 128-bit key derived from the client secret.
RSA1_5 - RSA with PKCS#1 v1.5 padding.
A256KW - AES Key Wrapping with 256-bit key derived from the client secret.
dir - Direct encryption with AES using the hashed client secret.
A192KW - AES Key Wrapping with 192-bit key derived from the client secret.

Default value:

ECDH-ES+A256KW
ECDH-ES+A192KW
ECDH-ES+A128KW
RSA-OAEP
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW

amster attribute: supportedRequestParameterEncryptionAlgorithms

Request Parameter Encryption Methods Supported

Encryption methods supported to decrypt Request parameter.

AM supports the following Request parameter encryption algorithms:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:

A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512

amster attribute: supportedRequestParameterEncryptionEnc

Supported Token Endpoint JWS Signing Algorithms.

Supported JWS Signing Algorithms for 'private_key_jwt' JWT-based authentication method.

Default value:

PS384
ES384
RS384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512

amster attribute: supportedTokenEndpointAuthenticationSigningAlgorithms

Authorized OIDC SSO Clients

Clients authorized to use OIDC ID tokens as SSO Tokens.

Allows clients to act with the full authority of the user. Grant this permission only to trusted clients.

amster attribute: authorisedOpenIdConnectSSOClients

UserInfo Signing Algorithms Supported

Algorithms supported to verify signature of the UserInfo endpoint. AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.

Default value:

ES384
HS256
HS512
ES256
RS256
HS384
ES512

amster attribute: supportedUserInfoSigningAlgorithms

UserInfo Encryption Algorithms Supported

Encryption algorithms supported by the UserInfo endpoint.

AM supports the following UserInfo endpoint encryption algorithms:

RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
` RSA-OAEP-256` - RSA with OAEP with SHA-256 and MGF-1.
` A128KW` - AES Key Wrapping with 128-bit key derived from the client secret.
` RSA1_5` - RSA with PKCS#1 v1.5 padding.
` A256KW` - AES Key Wrapping with 256-bit key derived from the client secret.
` dir` - Direct encryption with AES using the hashed client secret.
` A192KW` - AES Key Wrapping with 192-bit key derived from the client secret.

Default value:

ECDH-ES+A256KW
ECDH-ES+A192KW
RSA-OAEP
ECDH-ES+A128KW
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW

amster attribute: supportedUserInfoEncryptionAlgorithms

UserInfo Encryption Methods Supported

Encryption methods supported by the UserInfo endpoint.

AM supports the following UserInfo endpoint encryption methods:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:

A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512

amster attribute: supportedUserInfoEncryptionEnc

Token Introspection Response Signing Algorithms Supported

Algorithms that are supported for signing the Token Introspection endpoint JWT response.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.
RS384 - RSASSA-PKCS-v1_5 using SHA-384.
RS512 - RSASSA-PKCS-v1_5 using SHA-512.
EdDSA - EdDSA with SHA-512.

Default value:

PS384
RS384
EdDSA
ES384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512

amster attribute: supportedTokenIntrospectionResponseSigningAlgorithms

Token Introspection Response Encryption Algorithms Supported

Encryption algorithms supported by the Token Introspection endpoint JWT response.

AM supports the following Token Introspection endpoint encryption algorithms:

RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
RSA-OAEP-256 - RSA with OAEP with SHA-256 and MGF-1.
A128KW - AES Key Wrapping with 128-bit key derived from the client secret.
RSA1_5 - RSA with PKCS#1 v1.5 padding.
A256KW - AES Key Wrapping with 256-bit key derived from the client secret.
dir - Direct encryption with AES using the hashed client secret.
A192KW - AES Key Wrapping with 192-bit key derived from the client secret.

Default value:

ECDH-ES+A256KW
ECDH-ES+A192KW
RSA-OAEP
ECDH-ES+A128KW
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW

amster attribute: supportedTokenIntrospectionResponseEncryptionAlgorithms

Token Introspection Response Encryption Methods Supported

Encryption methods supported by the Token Introspection endpoint JWT response.

AM supports the following encryption methods:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:

A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512

amster attribute: supportedTokenIntrospectionResponseEncryptionEnc

Authorization Response Signing Algorithms Supported

Algorithms supported for signing the /oauth2/authorize endpoint JWT response.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256
HS384 - HMAC with SHA-384
HS512 - HMAC with SHA-512
RS256 - RSASSA-PKCS-v1_5 using SHA-256
RS384 - RSASSA-PKCS1-v1_5 using SHA-384
RS512 - RSASSA-PKCS1-v1_5 using SHA-512
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve
PS256 - RSASSA-PSS using SHA-256 and MGF1 with SHA-256
PS384 - RSASSA-PSS using SHA-384 and MGF1 with SHA-384
PS512 - RSASSA-PSS using SHA-512 and MGF1 with SHA-512

Default value:

PS384
ES384
RS384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512

amster attribute: supportedAuthorizationResponseSigningAlgorithms

Authorization Response Encryption Algorithms Supported

Algorithms supported for encrypting the /oauth2/authorize JWT response.

AM supports the following Token Introspection endpoint encryption algorithms:

RSA1_5 - RSA with PKCS#1 v1.5 padding.
RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
RSA-OAEP-256 - RSA with OAEP with SHA-256 and MGF-1.
A128KW - AES Key Wrapping with 128-bit key derived from the client secret.
A192KW - AES Key Wrapping with 192-bit key derived from the client secret.
A256KW - AES Key Wrapping with 256-bit key derived from the client secret.
dir - Direct encryption with AES using the hashed client secret.
ECDH-ES - Elliptic Curve Diffie-Hellman Ephemeral Static key agreement using Concat KDF.
ECDH-ES+A128KW - ECDH-ES using Concat KDF and CEK wrapped with A128KW.
ECDH-ES+A192KW - ECDH-ES using Concat KDF and CEK wrapped with A192KW.
ECDH-ES+A256KW - ECDH-ES using Concat KDF and CEK wrapped with A256KW.

Default value:

ECDH-ES+A256KW
ECDH-ES+A192KW
RSA-OAEP
ECDH-ES+A128KW
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW

amster attribute: supportedAuthorizationResponseEncryptionAlgorithms

Authorization Response Encryption Methods Supported

Methods supported for encrypting the /oauth2/authorize JWT response.

AM supports the following encryption methods:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:

A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512

amster attribute: supportedAuthorizationResponseEncryptionEnc

Include all kty and alg combinations in jwks_uri

By default only distinct kid entries are returned in the jwks_uri and the alg property is not included. Enabling this flag will result in duplicate kid entries, each one specifying a different kty and alg combination (RFC7517 distinct key KIDs).

Default value: false

amster attribute: includeAllKtyAlgCombinationsInJwksUri

Use Force Authentication for prompt=login: If you specify the prompt=login parameter in the URL, AM forces the end user to authenticate even if they already have a valid session.

If this property is false (default), AM destroys the existing session and creates a new session after reauthentication.

If this property is true, AM performs a session upgrade on reauthentication.

Default value: false
Use Force Authentication for max_age: This property applies only to reauthentication triggered by the Default Max Age property of an OAuth 2.0 client.

If this property is false and the user requests authorization after the max_age has passed, AM destroys the existing session and creates a new session after reauthentication.

If this property is true and the user requests authorization after the max_age has passed, AM performs a session upgrade on reauthentication.

Default value: false

Device Flow

The following settings appear on the Device Flow tab:

Verification URL: The URL that the user will be instructed to visit to complete their OAuth 2.0 login and consent when using the device code flow.

amster attribute: verificationUrl
Device Completion URL: The URL that the user will be sent to on completion of their OAuth 2.0 login and consent when using the device code flow.

amster attribute: completionUrl
Device Code Lifetime (seconds): The lifetime of the device code, in seconds.

Default value: 300

amster attribute: deviceCodeLifetime
Device Polling Interval: The polling frequency for devices waiting for tokens when using the device code flow.

Default value: 5

amster attribute: devicePollInterval
User Code Character Length: The number of characters in the generated user code.

Default value: 8

amster attribute: deviceUserCodeLength
User Code Character Set: The set of characters to be used to generate a user code.

Consider limitations of low resolution mobile devices when defining a character sets. For example, the OAuth 2.0 Device Grant specification recommends removing characters that can be easily confused, such as "0" and "O" or "1", "l" and "I". You can find additional examples in RFC 8628.

Default value: 234567ACDEFGHJKLMNPQRSTWXYZabcdefhijkmnopqrstwxyz

amster attribute: deviceUserCodeCharacterSet

The following settings appear on the Consent tab:

Saved Consent Attribute Name

Name of a multi-valued attribute on resource owner profiles where AM can save authorization consent decisions.

When the resource owner chooses to save the decision to authorize access for a client application, then AM updates the resource owner’s profile to avoid having to prompt the resource owner to grant authorization when the client issues subsequent authorization requests.

amster attribute: savedConsentAttribute

Allow Clients to Skip Consent

If enabled, clients can be configured so that the resource owner won’t be asked for consent during authorization flows.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: false

amster attribute: clientsCanSkipConsent

Enable Remote Consent

Enables consent to be gathered by a separate service.

This setting can be overridden at the client level. Learn more in client profile configuration.

Default value: false

amster attribute: enableRemoteConsent

Remote Consent Service ID

The ID of an existing remote consent service agent.

The possible values for this property are:

[Empty]

This setting can be overridden at the client level. Learn more in client profile configuration.

amster attribute: remoteConsentServiceId

Remote Consent Service Request Signing Algorithms Supported

Algorithms supported to sign consent_request JWTs for Remote Consent Services.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.

Default value:
```
PS384
ES384
RS384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512
```
amster attribute: supportedRcsRequestSigningAlgorithms

Remote Consent Service Request Encryption Algorithms Supported

Encryption algorithms supported to encrypt Remote Consent Service requests.

AM supports the following encryption algorithms:

RSA1_5 - RSA with PKCS#1 v1.5 padding.
RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
RSA-OAEP-256 - RSA with OAEP with SHA-256 and MGF-1.
A128KW - AES Key Wrapping with 128-bit key derived from the client secret.
A192KW - AES Key Wrapping with 192-bit key derived from the client secret.
A256KW - AES Key Wrapping with 256-bit key derived from the client secret.
dir - Direct encryption with AES using the hashed client secret.

Default value:
```
ECDH-ES+A256KW
ECDH-ES+A192KW
RSA-OAEP
ECDH-ES+A128KW
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW
```
amster attribute: supportedRcsRequestEncryptionAlgorithms

Remote Consent Service Request Encryption Methods Supported

Encryption methods supported to encrypt Remote Consent Service requests.

AM supports the following encryption methods:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:
```
A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512
```
amster attribute: supportedRcsRequestEncryptionMethods

Remote Consent Service Response Signing Algorithms Supported

Algorithms supported to verify signed consent_response JWT from Remote Consent Services.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

HS256 - HMAC with SHA-256.
HS384 - HMAC with SHA-384.
HS512 - HMAC with SHA-512.
ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
ES384 - ECDSA with SHA-384 and NIST standard P-384 elliptic curve.
ES512 - ECDSA with SHA-512 and NIST standard P-521 elliptic curve.
RS256 - RSASSA-PKCS-v1_5 using SHA-256.

Default value:
```
PS384
ES384
RS384
HS256
HS512
ES256
RS256
HS384
ES512
PS256
PS512
RS512
```
amster attribute: supportedRcsResponseSigningAlgorithms

Remote Consent Service Response Encryption Algorithms Supported

Encryption algorithms supported to decrypt Remote Consent Service responses.

AM supports the following encryption algorithms:

RSA1_5 - RSA with PKCS#1 v1.5 padding.
` RSA-OAEP` - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.
` RSA-OAEP-256` - RSA with OAEP with SHA-256 and MGF-1.
` A128KW` - AES Key Wrapping with 128-bit key derived from the client secret.
` A192KW` - AES Key Wrapping with 192-bit key derived from the client secret.
` A256KW` - AES Key Wrapping with 256-bit key derived from the client secret.
` dir` - Direct encryption with AES using the hashed client secret.

Default value:
```
ECDH-ES+A256KW
ECDH-ES+A192KW
ECDH-ES+A128KW
RSA-OAEP
RSA-OAEP-256
A128KW
A256KW
ECDH-ES
dir
A192KW
```
amster attribute: supportedRcsResponseEncryptionAlgorithms

Remote Consent Service Response Encryption Methods Supported

Encryption methods supported to decrypt Remote Consent Service responses.

AM supports the following encryption methods:

A128GCM, A192GCM, and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 - AES encryption in CBC mode, with HMAC-SHA-2 for integrity.

Default value:
```
A256GCM
A192GCM
A128GCM
A128CBC-HS256
A192CBC-HS384
A256CBC-HS512
```
amster attribute: supportedRcsResponseEncryptionMethods

CIBA

The following settings appear on the CIBA tab:

Back Channel Authentication ID Lifetime (seconds)

The time back channel authentication request id is valid for, in seconds.

Default value: 600

amster attribute: cibaAuthReqIdLifetime

Polling Wait Interval (seconds)

The minimum amount of time in seconds that the Client should wait between polling requests to the token endpoint

Default value: 2

amster attribute: cibaMinimumPollingInterval

Signing Algorithms Supported

Algorithms supported to sign the CIBA request parameter.

AM supports signing algorithms listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS:

ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
PS256 - RSASSA-PSS using SHA-256.

Default value:
```
ES256
PS256
```
amster attribute: supportedCibaSigningAlgorithms

Plugins

The Plugins settings are used to configure the following supported OAuth 2.0 plugin extension points:

Access Token Modification
OIDC Claims
Scope Evaluation
Scope Validation
Authorize Endpoint Data Provider

Each plugin is configured using three different attributes:

Plugin Type:

This value can be either SCRIPTED to run a custom script, or JAVA for a custom implementation class.
Script:

The script that is run for SCRIPTED plugin types.
Implementation Class:

The class that is invoked for JAVA plugin types. The class must implement the appropriate Java interface in the org.forgerock.oauth2.core.plugins package for the plugin.

These plugin settings can be overridden at the client level. Learn more in OAuth 2.0 provider overrides.

The following settings appear on the Plugins tab:

Access Token Modification Plugin Type: Default value: SCRIPTED

amster attribute: accessTokenModificationPluginType
Access Token Modification Script: This script is run when issuing an access token. The script lets you modify the token, for example, by altering the data fields, before it is persisted or returned to the client.

The script is run if Access Token Modification Plugin Type is set to SCRIPTED.

Learn more in Access token modification.

Default value: OAuth2 Access Modification Script

amster attribute: accessTokenModificationScript
Access Token Modifier Plugin Implementation Class: The Java class that provides the custom implementation for the access token modifier plugin interface, org.forgerock.oauth2.core.plugins.AccessTokenModifier. This class is invoked when Access Token Modification Plugin Type is set to JAVA.

Default value: [Empty]

amster attribute: accessTokenModificationClass
OIDC Claims Plugin Type: Default value: SCRIPTED

amster attribute: oidcClaimsPluginType
OIDC Claims Script: This script is run when issuing an ID token or during a request to the /userinfo OIDC endpoint. Use this script to retrieve claim values based on an issued access token.

The script is run if OIDC Claims Plugin Type is set to SCRIPTED.

Default value: OIDC Claims Script

amster attribute: oidcClaimsScript
OIDC Claims Plugin Implementation Class: The Java class that provides the custom implementation for the OIDC claims plugin interface, org.forgerock.oauth2.core.plugins.UserInfoClaimsPlugin. This class is invoked when OIDC Claims Plugin Type is set to JAVA.

Default value: [Empty]

amster attribute: oidcClaimsClass
Scope Evaluation Plugin Type: Default value: JAVA

amster attribute: evaluateScopePluginType
Scope Evaluation Script: This script retrieves and evaluates the scope information for an OAuth 2.0 access token.

The script lets you populate the scopes with profile attribute values. For example, if one of the scopes is mail, AM sets mail to the resource owner’s email address in the token information returned.

Default value: --- Select a script ---

amster attribute: evaluateScopeScript
Scope Evaluation Plugin Implementation Class: The Java class that provides the custom implementation for the evaluate scope plugin interface: org.forgerock.oauth2.core.plugins.ScopeEvaluator.

Default value: org.forgerock.oauth2.core.plugins.registry.DefaultScopeEvaluator

amster attribute: evaluateScopeClass
Scope Validation Plugin Type: Default value: JAVA

amster attribute: validateScopePluginType
Scope Validation Script: This script validates and customizes the set of requested scopes for authorize, access token, refresh token, and back channel authorize requests.

Default value: --- Select a script ---

amster attribute: validateScopeScript
Scope Validation Plugin Implementation Class: The Java class that provides the custom implementation for the evaluate scope plugin interface: org.forgerock.oauth2.core.plugins.ScopeValidator.

Default value: org.forgerock.oauth2.core.plugins.registry.DefaultScopeValidator

amster attribute: validateScopeClass
Authorize Endpoint Data Provider Plugin Type: Default value: JAVA

amster attribute: authorizeEndpointDataProviderPluginType
Authorize Endpoint Data Provider Script: Use this script to retrieve additional data from an authorization request, such as data from the user’s session or from an external service.

Default value: --- Select a script ---

amster attribute: authorizeEndpointDataProviderScript
Authorize Endpoint Data Provider Plugin Implementation Class: The Java class that provides the custom implementation for the evaluate scope plugin interface: org.forgerock.oauth2.core.plugins.AuthorizeEndpointDataProvider.

Default value: org.forgerock.oauth2.core.plugins.registry.DefaultEndpointDataProvider

amster attribute: authorizeEndpointDataProviderClass
Access Token Enricher Plugin Implementation Class: The class that provides the custom implementation for the access token enricher plugin interface.

The access token enricher plugin interface is deprecated and will be removed in a future release.

Default value: org.forgerock.oauth2.core.plugins.registry.DefaultAccessTokenEnricher

amster attribute: accessTokenEnricherClass
Device Code Flow User Code Generator Implementation Class: The class that provides the custom implementation for generating user codes for the device code flow.

To override the default implementation, create a Java class that implements the UserCodeGenerator interface, and set this property to the fully qualified class name.

Default value: org.forgerock.oauth2.core.plugins.registry.DefaultUserCodeGenerator

amster attribute: userCodeGeneratorClass

PingOne Worker service

The PingOne Worker Service requires a configured OAuth2 provider service in your AM server.

Refer to Authorization server configuration.

Configuration

The following settings appear on the Configuration tab:

Enabled: Enables the service.

Secondary Configurations

This service has the following Secondary Configurations:

Client ID

Client ID of the worker application in PingOne.

For more information, refer to Adding a worker application for the PingOne Authorize service.

Client Secret Label Identifier

AM uses this identifier to create a specific secret label for the client secret of the worker application.

The secret label uses the template am.services.pingone.worker.identifier.clientsecret where identifier is the Client Secret Label Identifier value.

This field can only contain characters a-z, A-Z, 0-9, and . and can’t start or end with a period.

For information on how to map the client secret to the secret label, refer to Map and rotate secrets.

Environment ID

The environment that contains the worker application in PingOne.

PingOne API Server URL

The regional base URL of the PingOne API server.

Enter one of the following:

https://api.pingone.com/v1 - for the North America region (excluding Canada)
https://api.pingone.ca/v1 - for the Canada region
https://api.pingone.eu/v1 - for the European Union region
https://api.pingone.asia/v1 - for the Asia-Pacific region

Default: https://api.pingone.com/v1

PingOne Authorization Server URL

The regional base URL for the PingOne authorization server.

Enter one of the following:

https://auth.pingone.com - for the North America region (excluding Canada)
https://auth.pingone.ca - for the Canada region
https://auth.pingone.eu - for the European Union region
https://auth.pingone.asia - for the Asia-Pacific region

Default: https://auth.pingone.com

Platform

amster service name: Platform

The following settings are available in this service:

Platform Locale: Set the fallback locale used when the user locale cannot be determined.

Default value: en_US

amster attribute: locale

Policy configuration

amster service name: PolicyConfiguration

Global attributes

The following settings appear on the Global Attributes tab:

Resource Comparator: AM uses resource comparators to match resources specified in policy rules. When setting comparators on the command line, separate fields with | characters.

Default value: serviceType=iPlanetAMWebAgentService|class=com.sun.identity.policy.plugins.HttpURLResourceName|wildcard=|oneLevelWildcard=--|delimiter=/|caseSensitive=false

amster attribute: resourceComparators
Continue Evaluation on Deny Decision: If no, then AM stops evaluating policy as soon as it reaches a deny decision.

Default value: false

amster attribute: continueEvaluationOnDeny
Realm Alias Referrals: If yes, then AM allows creation of policies for HTTP and HTTPS resources whose FQDN matches the DNS alias for the realm even when no referral policy exists.

Default value: false

amster attribute: realmAliasReferrals

Realm defaults

The following settings appear on the Realm Defaults tab:

Primary LDAP Server

Configuration directory server host:port that AM searches for policy information. The default value is the directory server specified during setup.

Configure the directory server settings if you want to use an identity store in an LDAP filter condition in a policy.

These LDAP settings are only applicable to the identity repository of the LDAP accounts or groups used in the filter condition, and don’t affect how other data, such as policies or policy subjects, is stored.

Format: local AM server name | hostname:port

Multiple entries must be prefixed by local server name. Make sure to place the multiple entries on a single line and separate the hostname:port URLs with a space.

For example, am.example.com|ds.example.com:1389 ds.example.com:2389

Default value: openam.example.com:50636

amster attribute: ldapServer

LDAP Users Base DN

Base DN for LDAP Users subject searches.

Default value: dc=openam,dc=forgerock,dc=org

amster attribute: usersBaseDn

LDAP Bind DN

Bind DN to connect to the directory server for policy information.

If you enable mTLS, AM ignores this property. Default value: cn=Directory Manager

amster attribute: bindDn

LDAP Bind Password

Bind password to connect to the directory server for policy information.

If you enable mTLS, AM ignores this property.

amster attribute: bindPassword

LDAP Organization Search Filter

Search filter to match organization entries.

Default value: (objectclass=sunismanagedorganization)

amster attribute: realmSearchFilter

LDAP Users Search Filter

Search filter to match user entries.

Default value: (objectclass=inetorgperson)

amster attribute: usersSearchFilter

LDAP Users Search Scope

Search scope to find user entries.

The possible values for this property are:

SCOPE_BASE
SCOPE_ONE
SCOPE_SUB

Default value: SCOPE_SUB

amster attribute: usersSearchScope

LDAP Users Search Attribute

Naming attribute for user entries.

Default value: uid

amster attribute: usersSearchAttribute

Maximum Results Returned from Search

Search limit for LDAP searches.

Default value: 100

amster attribute: maximumSearchResults

Search Timeout

Time after which AM returns an error for an incomplete search, in seconds.

Default value: 5

amster attribute: searchTimeout

LDAP SSL/TLS

If enabled, AM connects securely to the directory server. This requires that you install the directory server certificate.

Default value: true

amster attribute: sslEnabled

LDAP Connection Pool Minimum Size

Minimum number of connections in the pool.

Default value: 1

amster attribute: connectionPoolMinimumSize

LDAP Connection Pool Maximum Size

Maximum number of connections in the pool.

Default value: 10

amster attribute: connectionPoolMaximumSize

Heartbeat Interval

Specifies how often should AM send a heartbeat request to the directory.

Use this option in case a firewall/loadbalancer can close idle connections, since the heartbeat requests will ensure that the connections won’t become idle.

Default value: 10

amster attribute: policyHeartbeatInterval

Heartbeat Unit

Defines the time unit corresponding to the Heartbeat Interval setting.

Use this option in case a firewall/loadbalancer can close idle connections, since the heartbeat requests will ensure that the connections won’t become idle.

The possible values for this property are:

Label: second (Value: SECONDS)
Label: minute (Value: MINUTES)
Label: hour (Value: HOURS)

Default value: SECONDS

amster attribute: policyHeartbeatTimeUnit

Subjects Result Time to Live

Maximum time that AM caches a subject result for evaluating policy requests, in minutes. A value of 0 prevents AM from caching subject evaluations for policy decisions.

Default value: 10

amster attribute: subjectsResultTTL

User Alias

If enabled, AM can evaluate policy for remote users aliased to local users.

Default value: false

amster attribute: userAliasEnabled

Check resources exist when Resource Server is updated

Check all registered resources exist when updating Resource Server.

Policy Set will check each registered Resource Types one by one against config datastore if enabled. Consider disabling this option if you have large number of Resource Types registered to a Policy Set.

Default value: true

amster attribute: checkIfResourceTypeExists

mTLS Enabled

Enables mutual TLS (mTLS) authentication between AM and this datastore.

When you enable mTLS, you must also:

Enable LDAP SSL/TLS.
Map the secret label am.policy.configuration.serice.mtls.cert to the alias you want to use for mTLS authentication to this store.

AM ignores the LDAP Bind DN and LDAP Bind Password when you enable mTLS.

Push Notification service

amster service name: PushNotification

Realm defaults

The following settings appear on the Realm Defaults tab:

SNS Access Key ID

Amazon Simple Notification Service Access Key ID. Learn more in Create an AWS (Push Auth) Credential in the Knowledge Base. You must log into Backstage to read this article.

For example, you might set this property to: AKIAIOSFODNN7EXAMPLE

amster attribute: accessKey

SNS Access Key Secret

Amazon Simple Notification Service Access Key Secret. Learn more in Create an AWS (Push Auth) Credential in the Knowledge Base. You must log into Backstage to read this article.

For greater security, you can store this secret in a secret store, instead of in the configuration.

Map the secret to the secret label am.services.pushnotification.sns.accesskey.secret.

If a secret is mapped to this secret label, AM uses that secret and ignores the value of the SNS Access Key Secret property.

If a secret is mapped to this secret label and AM can’t locate the secret, it falls back to the value of the SNS Access Key Secret property.

amster attribute: secret

SNS Endpoint for APNS

The Simple Notification Service endpoint in Amazon Resource Name format, used to send push messages to the Apple Push Notification Service (APNS).

For example, you might set this property to: arn:aws:sns:us-east-1:1234567890:app/APNS/production

amster attribute: appleEndpoint

SNS Endpoint for GCM

The Simple Notification Service endpoint in Amazon Resource Name format, used to send push messages over Google Cloud Messaging (GCM).

For example, you might set this property to: arn:aws:sns:us-east-1:1234567890:app/GCM/production

amster attribute: googleEndpoint

SNS Client Region

Region of your registered Amazon Simple Notification Service client. For more information, see https://docs.aws.amazon.com/general/latest/gr/rande.html.

The possible values for this property are:

us-gov-west-1
us-east-1
us-west-1
us-west-2
eu-west-1
eu-central-1
ap-southeast-1
ap-southeast-2
ap-northeast-1
ap-northeast-2
sa-east-1
n-north-1

Default value: us-east-1

amster attribute: region

Message Transport Delegate Factory

The fully qualified class name of the factory responsible for creating the PushNotificationDelegate. The class must implement org.forgerock.openam.services.push.PushNotificationDelegate.

Default value: org.forgerock.openam.services.push.sns.SnsHttpDelegateFactory

amster attribute: delegateFactory

Response Cache Duration

The minimum lifetime to keep unanswered message records in the message dispatcher cache, in seconds. To keep unanswered message records indefinitely, set this property to 0.

Default value: 120

amster attribute: mdDuration

Response Cache Concurrency

Level of concurrency to use when accessing the message dispatcher cache. Defaults to 16, and must be greater than 0. Choose a value to accommodate as many threads as will ever concurrently access the message dispatcher cache.

Default value: 16

amster attribute: mdConcurrency

Response Cache Size

Maximum size of the message dispatcher cache, in number of records. If set to 0 the cache can grow indefinitely. If the number of records that need to be stored exceeds this maximum, then older items in the cache will be removed to make space.

Default value: 10000

amster attribute: mdCacheSize

RADIUS server

amster service name: RadiusServer

Configuration

The following settings appear on the Configuration tab:

Enabled

Lets the AM RADIUS server listen for requests on the listener port, and handle the requests.

The possible values for this property are:

NO
YES

Default value: NO

amster attribute: radiusListenerEnabled

Listener Port

The UDP port on which each AM server will listen for RADIUS Access-Request packets

According to the RADIUS Authentication Specification, RFC 2865, the officially assigned port number for RADIUS is 1812. Specify a value from 1024 to 65535. All client requests are handled through the same port.

Default value: 1812

amster attribute: radiusServerPort

Thread Pool Core Size

When a RADIUS request is received and fewer than corePoolSize threads are running, a new thread is created to handle the request, even if other worker threads are idle. If there are more than "Thread Pool Core Size" but less than "Thread Pool Max Size" threads running, a new thread will be created only if the queue is full. By setting "Thread Pool Core Size" and "Thread Pool Max Size" to the same value, you create a fixed-size thread pool. Specify a value from 1 to 100.

Default value: 1

amster attribute: radiusThreadPoolCoreSize

Thread Pool Max Size

Maximum number of threads allowed in the pool. See also "Thread Pool Core Size".

Default value: 10

amster attribute: radiusThreadPoolMaxSize

Thread Pool Keep-Alive Seconds

If the pool currently has more than Thread Pool Core Size threads, excess threads will be terminated if they have been idle for more than the Keep-Alive Seconds. Specify a value from 1 to 3600.

Default value: 10

amster attribute: radiusThreadPoolKeepaliveSeconds

Thread Pool Queue Size

The number of requests that can be queued for the pool before further requests will be silently dropped. See also "Thread Pool Core Size" and "Thread Pool Max Size". Specify a value from 1 to 1000.

Default value: 20

amster attribute: radiusThreadPoolQueueSize

Secondary configurations

This service has the following secondary configurations.

radiusClient

Client IP Address

The IP Address of the client.

Section 5.4 of the RADIUS Authentication Specification, RFC 2865, indicates that the source IP address of the Access-Request packet MUST be used to identify a configured client and hence determine the shared secret to use for decrypting the User-Password field.

This property should hold the source IP address of the client. This should match the value obtained from Java’s InetSocketAddress.getAddress().toString() function.

To verify the value, send an Access-Request packet to AM’s RADIUS port and watch for a message stating: "No Defined RADIUS Client matches IP address '/127.0.0.1'. Dropping request.". The value used in this property should match the IP address returned in the single quotes.

Default value: /127.0.0.1

amster attribute: clientIpAddress

Client Secret

This secret shared between server and client for encryption of the user password.

This secret must be conveyed to the RADIUS client and entered into its configuration before the User-Password field of incoming Access-Request packets can be decrypted to validate the password for the represented by that packet.

amster attribute: clientSecret

Log Packet Contents for this Client

Indicates if full packet contents should be dumped to the log.

When troubleshooting issues with RADIUS it is helpful to know what was received in a given packet. Enabling this feature will cause packet contents to be logged in a human consumable format. The only caveat is that the USER_PASSWORD field will be obfiscated by replacing with asterisks. This should only be enabled for troubleshooting as it adds significant content to logs and slows processing.

Default value: NO

amster attribute: clientPacketsLogged

Handler Class

The fully qualified name of a class to handle incoming RADIUS Access-Requests for this client.

This class must implement the com.sun.identity.authentication.modules.radius.server.spi.AccessRequestHandler interface to handle incoming Access-Request packets and provide a suitable response. An instance of this class is created when configuration is first loaded to validate the class and then once for each new request. The configuration properties will only be passed for the request handling instances and not when validating the class.

Default value: org.forgerock.openam.radius.server.spi.handlers.OpenAMAuthHandler

amster attribute: handlerClass

Handler Class Configuration Properties

Properties needed by the handler class for its configuration.

These properties are provided to the handler via its init method prior to the call to handle the request packet. If these values are changed the next handler instance created for an incoming request will receive the updated values. Each entry assumes that the first ‘`=`’ character incurred separates a key from its value. All entries are placed in a properties file handed to each handler instance.

Default value:

realm=/
chain=ldapService

amster attribute: handlerConfig

Require Message-Authenticator Attribute

Indicates if the RADIUS server requires the Message-Authenticator attribute in the Access-Request request packet and whether the RADIUS server provides this attribute in the Access-Accept, Access-Reject and Access-Challenge responses.

You can use this attribute to verify incoming RADIUS access requests to prevent spoofing.

If you enable this property, the RADIUS server expects the Access-Request to contain a valid Message-Authenticator attribute (as defined in RFC 3579). If the attribute isn’t present or is invalid, AM silently drops the Access-Request.

Also, if you enable this property, the RADIUS server provides the Message-Authenticator attribute in its Access-Accept, Access-Reject and Access-Challenge responses.

Default: Enabled

REST APIs

amster service name: RestApis

The following settings are available in this service:

Default Resource Version

The API resource version to use when the REST request does not specify an explicit version.

The possible values for this property are:

Latest. If an explicit version is not specified, the latest resource version of an API is used.
Oldest. If an explicit version is not specified, the oldest supported resource version of an API is used. Note that since APIs may be deprecated and fall out of support, the oldest supported version may not be the first version.
None. If an explicit version is not specified, the request will not be handled and an error status is returned.

Default value: Latest

amster attribute: defaultVersion

Warning Header

Whether to include a warning header in the response to a request which fails to include the Accept-API-Version header.

Default value: true

amster attribute: warningHeader

API Descriptions

Whether API Explorer and API Docs are enabled in AM and how the documentation for them is generated. Dynamic generation includes descriptions from any custom services and authentication nodes you have added. Static generation only includes services and authentication nodes that were present when AM was built. The dynamic documentation generation might not work in some application containers.

The possible values for this property are:

Label: Enabled with Dynamic Documentation (Value: DYNAMIC)
Label: Enabled with Static Documentation (Value: STATIC)
DISABLED

Default value: STATIC

amster attribute: descriptionsState

Default Protocol Version

The API protocol version to use when a REST request does not specify an explicit version. Choose from:

The possible values for this property are:

Oldest. If an explicit version is not specified, the oldest protocol version is used.
Latest. If an explicit version is not specified, the latest protocol version is used.
None. If an explicit version is not specified, the request will not be handled and an error status is returned.

Default value: Latest

amster attribute: defaultProtocolVersion

Enable CSRF Protection

If enabled, all non-read/query requests will require the X-Requested-With header to be present.

Requiring a non-standard header ensures requests can only be made via methods (XHR) that have stricter same-origin policy protections in Web browsers, preventing Cross-Site Request Forgery (CSRF) attacks. Without this filter, cross-origin requests are prevented by the use of the application/json Content-Type header, which is less robust.

Default value: true

amster attribute: csrfFilterEnabled

Remote Consent service

amster service name: RemoteConsentService

Realm defaults

The following settings appear on the Realm Defaults tab:

Client Name: The name used to identify this OAuth 2.0 remote consent service when referencedin other services.

amster attribute: clientId
Authorization Server jwk_uri: The jwk_uri for retrieving the authorization server signing and encryption keys.

amster attribute: jwksUriAS
JWK Store Cache Timeout (in minutes): The cache timeout for the JWK store of the authorization server, in minutes.

Default value: 60

amster attribute: jwkStoreCacheTimeout
JWK Store Cache Miss Cache Time (in minutes): The length of time a cache miss is cached, in minutes.

Default value: 1

amster attribute: jwkStoreCacheMissCacheTime
Consent Response Time Limit (in minutes): The time limit set on the consent response JWT before it expires, in minutes.

Default value: 2

amster attribute: consentResponseTimeLimit

SAML v2.0 SOAP binding

amster service name: SamlV2SoapBinding

The following settings are available in this service:

Request Handler List: List of handlers to deal with SAML v2.0 requests bound to SOAP.

The required format is: key=Meta Alias|class=Handler Class

Set the key property for a request handler to the meta alias, and the class property to the name of the class that implements the handler.

For example: key=/pdp|class=com.sun.identity.xacml.plugins.XACMLAuthzDecisionQueryHandler

amster attribute: requestHandlers

SAML v2.0 service configuration

amster service name: SamlV2ServiceConfiguration

The following settings are available in this service:

Cache cleanup interval (in seconds)

Time between cache cleanup operations, in seconds.

Default value: 600

amster attribute: cacheCleanupInterval

Attribute name for Name ID information

User entry attribute to store name identifier information.

Default value: sun-fm-saml2-nameid-info

amster attribute: nameIDInfoAttribute

Attribute name for Name ID information key

User entry attribute to store the name identifier key.

Default value: sun-fm-saml2-nameid-infokey

amster attribute: nameIDInfoKeyAttribute

Cookie domain for IdP Discovery Service

Specifies the cookie domain for the IdP discovery service.

Default value: openam.example.com

amster attribute: idpDiscoveryCookieDomain

Cookie type for IdP Discovery Service

Specifies the cookie type to use.

The possible values for this property are:

PERSISTENT
SESSION

Default value: PERSISTENT

amster attribute: idpDiscoveryCookieType

URL scheme for IdP Discovery Service

Specifies the URL scheme to use.

The possible values for this property are:

HTTP
HTTPS

Default value: HTTPS

amster attribute: idpDiscoveryUrlSchema

XML Encryption SPI implementation class

Used by the SAML2 engine to encrypt and decrypt documents.

Default value: com.sun.identity.saml2.xmlenc.FMEncProvider

amster attribute: xmlEncryptionClass

Include xenc:EncryptedKey inside ds:KeyInfo Element

Specify whether to include the xenc:EncryptedKey property inside the ds:KeyInfo element.

Default value: true

amster attribute: encryptedKeyInKeyInfo

XML Signing SPI implementation class

Used by the SAML2 engine to sign documents.

Default value: com.sun.identity.saml2.xmlsig.FMSigProvider

amster attribute: xmlSigningClass

XML Signing Certificate Validation

If enabled, then validate certificates used to sign documents.

Default value: false

amster attribute: signingCertValidation

CA Certificate Validation

If enabled, then validate CA certificates.

Default value: false

amster attribute: caCertValidation

Buffer length (in bytes) to decompress request

Specify the size of the buffer used for decompressing requests, in bytes.

Default value: 2048

amster attribute: bufferLength

Scripting

amster service name: Scripting

Configuration

The following settings appear on the Configuration tab:

Default Script Type

The default script context type when creating a new script.

The possible values for this property are:

Label Value

OAuth2 Access Token Modification

OAUTH2_ACCESS_TOKEN_MODIFICATION

Saml2 SP Adapter

SAML2_SP_ADAPTER

Scripted Decision Node

SCRIPTED_DECISION_NODE

Client-side Authentication

AUTHENTICATION_CLIENT_SIDE

Decision node script for authentication trees

AUTHENTICATION_TREE_DECISION_NODE

Device Match Node

DEVICE_MATCH_NODE

OAuth2 Trusted JWT Issuer

OAUTH2_SCRIPTED_JWT_ISSUER

Server-side Authentication

AUTHENTICATION_SERVER_SIDE

Social Identity Provider Profile Transformation

SOCIAL_IDP_PROFILE_TRANSFORMATION

Library

LIBRARY

OAuth2 Validate Scope

OAUTH2_VALIDATE_SCOPE

Config Provider

CONFIG_PROVIDER_NODE

OAuth2 Dynamic Client Registration

OAUTH2_DYNAMIC_CLIENT_REGISTRATION

OAuth2 Authorize Endpoint Data Provider

OAUTH2_AUTHORIZE_ENDPOINT_DATA_PROVIDER

OAuth2 Evaluate Scope

OAUTH2_EVALUATE_SCOPE

Policy Condition

POLICY_CONDITION

OIDC Claims

OIDC_CLAIMS

Saml2 IDP Adapter

SAML2_IDP_ADAPTER

PingOne Verify Completion Decision Node

PINGONE_VERIFY_COMPLETION_DECISION_NODE

Policy Condition (Next-Gen)

POLICY_CONDITION_NEXT_GEN

Saml2 NameID Mapper

SAML2_NAMEID_MAPPER

Saml2 IDP Attribute Mapper

SAML2_IDP_ATTRIBUTE_MAPPER

OAuth2 May Act

OAUTH2_MAY_ACT

Config Provider Node (Next-Gen)

CONFIG_PROVIDER_NODE_NEXT_GEN

Default value: Policy Condition

amster attribute: defaultContext

Secondary configurations

Configure script engine parameters for running a particular script type in AM.

A secondary configuration instance has the following tabs:

Configuration

Scripting languages: Select the languages available for scripts on the chosen type. Either GROOVY or JAVASCRIPT.

ssoadm attribute: languages
Default Script: The source code that is presented as the default when creating a new script of this type.

ssoadm attribute: defaultScript

Default Scripts

The default scripts for this secondary configuration.

Secondary Configurations

This service has the following secondary configurations.

engineConfiguration

The script engine configuration for scripts of this type.

ssoadm attribute: engineConfiguration

To access a secondary configuration instance using the ssoadm command, use: --subconfigname [primary configuration]/[secondary configuration]. For example:

$ ssoadm set-sub-cfg \
  --adminid uid=amAdmin,ou=People,dc=am,dc=example,dc=com \
  --password-file admin_pwd_file \
  --servicename ScriptingService \
  --subconfigname OIDC_CLAIMS/engineConfiguration \
  --operation set \
  --attributevalues maxThreads=300 queueSize=-1

bash

Supports server-side scripts only. AM cannot configure engine settings for client-side scripts.

ssoadm attribute: `

Property Name Prefix

This prefix must match the property name prefix used in the script. For example, if the property name is custom.script.property, the prefix is custom.script.

ssoadm attribute: propertyNamePrefix

Server-side Script Timeout

The maximum execution time any individual script should take on the server (in seconds). AM terminates scripts which take longer to run than this value.

ssoadm attribute: serverTimeout

Core thread pool size

The initial number of threads in the thread pool from which scripts operate. AM will ensure the pool contains at least this many threads.

ssoadm attribute: coreThreads

Maximum thread pool size

The maximum number of threads in the thread pool from which scripts operate. If no free thread is available in the pool, AM creates new threads in the pool for script execution up to the configured maximum. It is recommended to set the maximum number of threads to 300.

ssoadm attribute: maxThreads

Thread pool queue size

The size of the queue to use for buffering requests for script execution when all core threads are in use. When the core thread pool is at capacity, new script execution requests are queued up to this limit.

For short, CPU-bound scripts, consider a small pool size and larger queue length. For I/O-bound scripts such as REST calls, consider a larger maximum pool size and a smaller queue.

Not hot-swappable: restart server for changes to take effect.

ssoadm attribute: queueSize

Thread idle timeout (seconds)

Length of time (in seconds) for a thread to be idle before AM terminates created threads. If the current pool size contains the number of threads set in Core thread pool size idle threads aren’t terminated, to maintain the initial pool size.

ssoadm attribute: idleTimeout

Java class allowlist

The list of class-name patterns allowed to be invoked by the script. Every class accessed by the script must match at least one of these patterns.

You can specify the class name as-is or use a regular expression.

This only applies to legacy scripts. You can’t add classes to the allowlist for a next-generation script.

ssoadm attribute: whiteList

Java class denylist

The list of class-name patterns that are NOT allowed to be invoked by the script. The denylist is applied AFTER the allowlist to exclude those classes. Access to a class specified in both the allowlist and the denylist will be denied.

You can specify the class name to exclude as-is or use a regular expression.

ssoadm attribute: blackList

Use system SecurityManager

If enabled, AM makes a call to System.getSecurityManager().checkPackageAccess(…) for each class that is accessed. The method throws SecurityException if the calling thread is not allowed to access the package.

This feature only takes effect if the security manager is enabled for the JVM.

ssoadm attribute: useSecurityManager

Session

amster service name: SessionUserService

General

The following settings appear on the General tab:

Latest Access Time Update Frequency: Defaults to 60 seconds. At most, AM updates an authenticated session’s latest access time this often.

Subsequent changes to the authenticated session that occur within the specified number of seconds after an update don’t cause additional updates to the authenticated session’s access time. Refreshing an authenticated session returns the idle time as the number of seconds since an update has occurred, which will be between 0 and the specified Latest Access Time Update Frequency.

Default value: 60

amster attribute: latestAccessTimeUpdateFrequency
DN Restriction Only Enabled: If enabled, AM will not perform DNS lookups when checking restrictions in cookie hijacking mode.

Default value: false

amster attribute: dnRestrictionOnly
Session Timeout Handler implementations: Lists plugin classes implementing session timeout handlers. Specify the fully qualified name.

amster attribute: timeoutHandlers

Enable Cross Upgrade Session Reference: If enabled, the session contains an additional session reference property whose value is persisted across a session upgrade.

To access the cross-upgrade session reference—for example, from within a script or when getting session information—allowlist the property XUSRef in the Session Property Whitelist service.

Track the session reference in the audit logs for session creation and session upgrade events.

amster attribute: crossUpgradeReferenceFlag

Session search

The following settings appear on the Session Search tab:

Maximum Number of Search Results: Maximum number of results from a session search. Do not set this attribute to a large value, for example more than 1000, unless sufficient system resources are allocated.

Default value: 120

amster attribute: maxSessionListSize
Timeout for Search: Time after which AM sees an incomplete search as having failed, in seconds.

Default value: 5

amster attribute: sessionListRetrievalTimeout

Session property change notifications

The following settings appear on the Session Property Change Notifications tab:

Enable Property Change Notifications

If enabled, AM notifies other applications participating in SSO when a session property in the Notification Properties list changes on a server-side session.

The possible values for this property are:

ON
OFF

Default value: OFF

amster attribute: propertyChangeNotifications

Notification Properties

Lists session properties for which AM can send notifications upon modification. Session notification applies to server-side sessions only.

amster attribute: notificationPropertyList

Session quotas

The following settings appear on the Session Quotas tab:

Enable Quota Constraints

If enabled, AM lets you set quota constraints on server-side sessions.

The possible values for this property are:

ON
OFF

Default value: OFF

amster attribute: iplanet-am-session-enable-session-constraint

Read Timeout for Quota Constraint

Maximum wait time after which AM considers a search for live session count as having failed if quota constraints are enabled, in milliseconds.

Default value: 6000

amster attribute: quotaConstraintMaxWaitTime

Resulting behavior if session quota exhausted

Specify the action to take if a session quota is exhausted:

The possible values for this property are:

Deny Access (org.forgerock.openam.session.service.DenyAccessAction). New session creation requests are denied.
Destroy Next Expiring org.forgerock.openam.session.service.DestroyNextExpiringAction). The session that would expire next is destroyed.
Destroy Oldest (org.forgerock.openam.session.service.DestroyOldestAction). The oldest session is destroyed.
Destroy All (org.forgerock.openam.session.service.DestroyAllAction). All previous sessions are destroyed.

Default value: org.forgerock.openam.session.service.DestroyNextExpiringAction

amster attribute: behaviourWhenQuotaExhausted

Deny user login when session repository is down

This property only takes effect when the session quota constraint is enabled, and the session datastore is unavailable.

The possible values for this property are:

YES
NO

Default value: NO

amster attribute: denyLoginWhenRepoDown

Client-side sessions

The following settings appear on the Client-Side Sessions tab:

Signing Algorithm Type

The algorithm that AM uses to sign the JSON Web Token (JWT) containing the session content. Signing the JWT enables tampering detection.

The possible values for this property are:

NONE
HS256. HMAC using SHA-256.
HS384. HMAC using SHA-384.
HS512. HMAC using SHA-512.
RS256. RSASSA-PKCS1-v1_5 using SHA-256.
ES256. ECDSA using SHA-256 and NIST standard P-256 elliptic curve.
ES384. ECDSA using SHA-384 and NIST standard P-384 elliptic curve.
ES512. ECDSA using SHA-512 and NIST standard P-521 elliptic curve.

Default value: HS256

amster attribute: statelessSigningType

Signing HMAC Shared Secret

Specifies the shared secret that AM uses when performing HMAC signing on the session JWT.

Specify a shared secret when using a "Signing Algorithm Type" of HS256, HS384, or HS512.

amster attribute: statelessSigningHmacSecret

Encryption Algorithm

Specifies the algorithm that AM uses to encrypt the JSON Web Token (JWT) containing the session content.

The possible values for this property are:

NONE. Session content is not encrypted.
RSA. Session content is encrypted with AES using a unique key. The key is then encrypted with an RSA public key and appended to the JWT.

AM supports the following padding modes, which you can set using the org.forgerock.openam.session.stateless.rsa.padding advanced property:
- RSA1_5. RSA with PKCS#1 v1.5 padding.
- RSA-OAEP. RSA with optimal asymmetric encryption padding (OAEP) and SHA-1.
- RSA-OAEP-256. RSA with OAEP padding and SHA-256.
AES_KEYWRAP. AES key wrapping.

Session content is encrypted with AES using a unique key and is then wrapped using AES KeyWrap and the master key. This provides additional security, compared to RSA, at the cost of 128 or 256 bits (or 32 bytes) depending on the size of the master key. This method provides authenticated encryption, which removes the need for a separate signature and decreases the byte size of the JWT. See RFC 3394.
DIRECT. Direct AES encryption.

Session content is encrypted with direct AES encryption, with a symmetric key. This method provides authenticated encryption, which removes the need for a separate signature and decreases the byte size of the JWT.

Users can accidentally disable all authentication by disabling signing and not using an authenticated encryption mode. To prevent this, set the org.forgerock.openam.session.stateless.signing.allownone system property to true to turn off signing completely.

Default value: DIRECT

amster attribute: statelessEncryptionType

Encryption Symmetric AES Key

AES key for use with Direct or AES KeyWrap encryption modes.

The symmetric AES key is a base64-encoded random key.

For direct encryption with AES-GCM or for AES-KeyWrap with any content encryption method, this should be 128, 192, or 256 bits.

For direct encryption with AES-CBC-HMAC, the key should be double those sizes (one half for the AES key, the other have for the HMAC key).

amster attribute: statelessEncryptionAesKey

Compression Algorithm

If enabled the session state is compressed before signing and encryption.

Enabling compression can compromise encryption. This may leak information about the content of the session state if encryption is enabled.

The possible values for this property are:

NONE
DEF. Deflate Compression.

Default value: NONE

amster attribute: statelessCompressionType

Enable Session Denylisting

Denylists client-side sessions that log out.

Enable this setting if the maximum session time is high. The denylist state is stored in the Core Token Service (CTS) token store until the session expires, to ensure that sessions cannot continue to be used.

Default value: false

amster attribute: openam-session-stateless-enable-session-blacklisting

Session Denylist Cache Size

Number of denylisted sessions to cache in memory to speed up denylist checks and reduce load on the CTS. The cache size should be approximately the number of logouts expected in the maximum session time.

Default value: 10000

amster attribute: openam-session-stateless-blacklist-cache-size

Denylist Poll Interval (seconds)

Specifies the interval at which AM polls the Core Token Service to update the list of signed out sessions, in seconds.

The longer the polling interval, the more time a malicious user has to connect to other AM servers in a deployment and make use of a stolen session cookie. Shortening the polling interval improves security for signed-out sessions, but might incur a minimal decrease in overall AM performance due to increased network activity. Set to 0 to disable this feature completely.

Default value: 10

amster attribute: openam-session-stateless-blacklist-poll-interval

Denylist Purge Delay (minutes)

When added to the maximum session time, specifies the amount of time that AM tracks logged out sessions.

Increase the denylist purge delay if you expect system clock skews in your deployment to be greater than one minute. You don’t need to increase the denylist purge delay for servers running a clock synchronization protocol, such as the Network Time Protocol.

Default value: 1

amster attribute: openam-session-stateless-blacklist-purge-delay

Enable Invalidation of Sessions Based on User Identifier: Let AM permit logging out all client-side sessions for a specific user, through the logoutByUser action.

Setting this to true causes AM to store logout user tokens in a local cache. For multi-server deployments, AM polls the CTS at a specified interval and populates the cache with the logout user tokens of all servers in the deployment.

Default value: false

amster attribute: statelessLogoutByUser
Invalidated Sessions Poll Interval (seconds): When Enable Invalidation of Sessions Based on User Identifier is true, this setting specifies the frequency at which AM polls the CTS for changes to persisted logout tokens.

Default value: 60

amster attribute: openam-session-stateless-logout-poll-interval

Dynamic attributes

Configuring any of the following properties at the realm level (Realms > Realm Name > Services > Session) causes the values to be stored in the identity store configured in that realm.

If you remove the identity store from the realm, the properties will use the values configured at the global level (Configure > Global Services > Session).

The following settings appear on the Dynamic Attributes tab:

Maximum Session Time

Maximum time a session can remain valid before AM requires the user to authenticate again, in minutes.

Default value: 120

amster attribute: maxSessionTime

Maximum Idle Time

Maximum time a server-side session can remain idle before AM requires the user to authenticate again, in minutes.

Default value: 30

amster attribute: maxIdleTime

Maximum Caching Time

Maximum duration that external AM clients should cache the session, in minutes.

Default value: 3

amster attribute: maxCachingTime

Active User Sessions

Maximum number of concurrent server-side authenticated sessions per user.

Default value: 5

This value doesn’t apply if Enable Quota Constraints is OFF. In other words, session quota constraints must be enabled for any configured maximum to apply.

amster attribute: quotaLimit

Session Property Whitelist service

amster service name: SessionPropertyWhiteList

Realm defaults

The following settings appear on the Realm Defaults tab:

Allowlisted Session Property Names

A list of properties that users may read, edit the value of, or delete from their session.

Adding properties to sessions can impact AM’s performance. There is no limit on the set of properties that you can add to sessions, and no limit on the number of session properties you can add.

Adding session properties can increase the load on an AM deployment in the following areas:

AM server memory
LDAP server storage
LDAP server replication

Protected attributes can’t be set, edited or deleted, even if they are included in this allowlist.

Default value: AMCtxId

amster attribute: sessionPropertyWhitelist

Session Properties to return for session queries

A list of session properties that can be returned to admins in a REST session query response.

This setting can impact REST query performance. When session properties are added, the CTS token must be retrieved, and can be decrypted and decompressed, if configured.

Protected attributes can’t be set, edited or deleted, even if they are included in this list.

amster attribute: whitelistedQueryProperties

Social authentication implementations

This service was used only for authentication with modules and chains and is no longer documented.

Social Identity Provider service

amster service name: SocialIdentityProviders

Realm defaults

The following settings appear on the Realm Defaults tab:

Enabled: Default value: true

amster attribute: enabled

Secondary configurations

Learn about the secondary configuration settings in Social identity provider client configuration.

Transaction Authentication service

amster service name: TransactionAuthentication

Realm defaults

The following settings appear on the Realm Defaults tab:

Time to Live: The number of seconds within which the transaction must be completed.

Default value: 180

amster attribute: timeToLive

UMA provider

amster service name: UmaProvider

Global Attributes

The following settings appear on the Global Attributes tab:

UMA Policy Upgrade Compatibility Mode: When this setting is enabled, AM creates backward-compatible UMA policies. Enable this setting when you are upgrading from servers prior to AM 7.2.0, and when you are upgrading multiple servers in a deployment at different times. Disable this setting when you have completed the upgrade for all AM instances in your deployment.

Default value: false

amster attribute: umaPolicyUpgradeCompatibilityMode

General

The following settings appear on the General tab:

Permission Ticket Lifetime (seconds)

The maximum life of a permission ticket before it expires, in seconds.

Default value: 120

amster attribute: permissionTicketLifetime

Delete user policies when Resource Server is removed

Delete all user policies that relate to a Resource Server when removing the OAuth2 agent entry or removing the uma_protection scope from the OAuth2 agent.

Default value: true

amster attribute: deletePoliciesOnDeleteRS

Delete resources when Resource Server is removed

Delete all resources that relate to a Resource Server when removing the OAuth2 agent entry or removing the uma_protection scope from the OAuth2 agent.

Default value: true

amster attribute: deleteResourceSetsOnDeleteRS

Pending Requests Enabled

Use the Pending Requests subsystem to notify the resource owner that an attempt was made to access their resource.

Default value: true

amster attribute: pendingRequestsEnabled

Email Resource Owner on Pending Request creation

Send an email to the Resource Owner when a Pending Request is created, when a Requesting Party requests access to a resource.

Default value: true

amster attribute: emailResourceOwnerOnPendingRequestCreation

Email Requesting Party on Pending Request approval

Send an email to the Requesting Party when a Pending Request is approved by the Resource Owner.

Default value: true

amster attribute: emailRequestingPartyOnPendingRequestApproval

Grant Resource Owner Implicit Consent

Implicitly grant the resource owner consent to the resource, regardless of policy conditions.

Default value: true

amster attribute: resourceOwnerImplicitConsent

User profile preferred Locale attribute

User profile attribute storing the user’s preferred locale.

Default value: inetOrgPerson

amster attribute: userProfileLocaleAttribute

Re-Sharing Mode

Specifies whether re-sharing is off or on implicitly for all users, allowing all users to re-share resources that have been shared with them.

The possible values for this property are:

Off
Implicit

Default value: Implicit

amster attribute: resharingMode

Grant RPTs…

In UMA, scope comes from both the permission ticket and from the token request. An RPT is always granted when all scopes match, and is never granted when no scope matches. You can configure when RPTs are granted for partial match conditions here. For more information, see Assessment and Results Determination in the UMA 2.0 Grant Specification.

Default value:

When the scope from the request is partially matched.
When none of the scope from the request is matched.
When the scope from the ticket is partially matched.

amster attribute: grantRptConditions

Username attribute

The name of the attribute whose value must be specified by end users when sharing resources. For example, if a user wants to share a resource with another user, based on that user’s email address, set this value to mail.

The attribute that you set here must contain unique values; otherwise, a resource share can grant access to multiple users unintentionally.

If you leave this attribute empty, UMA policies are based on the attribute that the underlying datastore considers the username (for example, the LDAP user search attribute). This behavior is compatible with previous AM versions. The UMA Postman Collection sets this value to uid, which works in most deployments.

Changing this setting can invalidate existing UMA authorizations.

Default value: None

amster attribute: usernameAttribute

Claims gathering

The following properties can be set on the Claims Gathering tab:

Interactive Claims Gathering Enabled: If this setting is enabled, and no PCT is provided on the request, the UMA provider returns a redirect_user hint to the client, where the requesting party can authenticate themselves.

Default value: false

amster attribute: interactiveClaimsGatheringEnabled
Claims Gathering Authentication Tree: The authentication tree to which the requesting party should be directed, in order to collect claims. This authentication tree should collect all claims necessary for successful UMA authorization.

Default value: None

amster attribute: claimsGatheringTree
Persisted Claims Token Lifetime (seconds): During interactive claims gathering, AM can issue a PCT, that clients can use later during RPT flows, so that users don’t have to go through the interactive claims gathering process too frequently.

If a PCT is issued, this setting determines the interval (in seconds) that the PCT should be considered valid.

Default value: 604800 (7 days)

amster attribute: pctLifetime

Warn on confusable characters in username: When enabled, the UI displays a warning on pending share requests or existing resource permissions if the username of the requesting party contains confusable characters from different unicode scripts, for example 𝝲 and y.

The warning displayed is Warning: This username contains confusable characters. Make sure this is the correct person before allowing them access.

Pending request and resource set REST responses can include an additional field to indicate that confusable characters are present.

Default value: false

amster attribute: warnIfConfusablesInUsername

User

amster service name: IdRepositoryUser

Dynamic attributes

The following settings appear on the Dynamic Attributes tab:

User Preferred Timezone

Time zone for accessing AM admin UI.

amster attribute: preferredTimezone

Administrator DN Starting View

Specifies the DN for the initial screen when the AM administrator successfully logs in to the AM admin UI.

amster attribute: adminDNStartingView

Default User Status

Inactive users cannot authenticate, although AM stores their profiles.

The possible values for this property are:

Active
Inactive

Default value: Active

amster attribute: defaultUserStatus

User Self-Service

amster service name: UserSelfService

General configuration

The following settings appear on the General Configuration tab:

Encryption Key Pair Alias

An encryption key alias in the AM server’s JCEKS keystore. Used to encrypt the JWT token that AM uses to track end users during User Self-Service operations.

For example, you might set this property to: selfserviceenctest

amster attribute: encryptionKeyPairAlias

Signing Secret Key Alias

A signing secret key alias in the AM server’s JCEKS keystore. Used to sign the JWT token that AM uses to track end users during User Self-Service operations.

For example, you might set this property to: selfservicesigntest

amster attribute: signingSecretKeyAlias

Google reCAPTCHA Site Key

Google reCAPTCHA plugin site key.

amster attribute: captchaSiteKey

Google reCAPTCHA Secret Key

Google reCAPTCHA plugin secret key.

amster attribute: captchaSecretKey

Google Re-captcha Verification URL

Google reCAPTCHA plugin verification URL.

Default value: https://www.google.com/recaptcha/api/siteverify

amster attribute: captchaVerificationUrl

Security Questions

Specifies the default set of knowledge-based authentication (KBA) security questions. The security questions can be set for the User Self-Registration, forgotten password reset, and forgotten username services, respectively.

Format is unique key|locale|question.

Default value:

4|en|What is your mother&#39;s maiden name?
3|en|What was the name of your childhood pet?
2|en|What was the model of your first car?
1|en|What is the name of your favourite restaurant?

amster attribute: kbaQuestions

Minimum Answers to Define

Specifies the minimum number of KBA answers that users must define.

Default value: 1

amster attribute: minimumAnswersToDefine

Minimum Answers to Verify

Specifies the minimum number of KBA questions that users need to answer to be granted the privilege to carry out an action, such as registering for an account, resetting a password, or retrieving a username. Specify a value from 0 to 50.

Default value: 1

amster attribute: minimumAnswersToVerify

Valid Query Attributes

Specifies the valid query attributes used to search for the user. This is a list of attributes used to identify your account for forgotten password and forgotten username.

Default value:

uid
mail
givenName
sn

amster attribute: validQueryAttributes

User registration

The following settings appear on the User Registration tab:

User Registration

If enabled, new users can sign up for an account.

Default value: false

amster attribute: userRegistrationEnabled

Captcha

If enabled, users must pass a Google reCAPTCHA challenge during user self-registration to mitigate against software bots.

Default value: false

amster attribute: userRegistrationCaptchaEnabled

Email Verification

If enabled, users who self-register must perform email address verification.

Default value: true

amster attribute: userRegistrationEmailVerificationEnabled

Verify Email before User Detail

If enabled, email address verification will be performed first before user details screen is displayed. This will take effect only if Verify Email is enabled.

Default value: false

amster attribute: userRegistrationEmailVerificationFirstEnabled

Security Questions

If enabled, users must set up their security questions during the self-registration process.

Default value: false

amster attribute: userRegistrationKbaEnabled

Token Lifetime (seconds)

Maximum lifetime of the token allowing User Self-Registration, in seconds.

Default value: 300

amster attribute: userRegistrationTokenTTL

Outgoing Email Subject

Customize the User Self-Registration verification email subject text. Format is locale|subject text.

Default value: en|Registration email

amster attribute: userRegistrationEmailSubject

Outgoing Email Body

Customize the User Self-Registration verification email body text. Format is: locale|body text.

Default value: en|<h2>Click on this <a href="%link%">link</a> to register.</h2>

amster attribute: userRegistrationEmailBody

Valid Creation Attributes

Specifies an allowlist of user attributes that can be set during user creation.

Default value:

userPassword
mail
givenName
kbaInfo
inetUserStatus
sn
username

amster attribute: userRegistrationValidUserAttributes

Destination After Successful Self-Registration

The action to be taken after a user successfully registers a new account.

The possible values for this property are:

Label: User sent to 'successful registration' page (value: default). User is sent to a success page, without being logged in.
Label: User sent to login page (value: login). User is sent to the login page to authenticate.
Label: User is automatically logged in (value: auto-login). User is automatically logged in and sent to the appropriate page.

Default value: default

amster attribute: userRegisteredDestination

Forgotten password

The following settings appear on the Forgotten Password tab:

Forgotten Password: If enabled, users can reset their forgotten password.

Default value: false

amster attribute: forgottenPasswordEnabled
Captcha: If enabled, users must pass a Google reCAPTCHA challenge during password reset to mitigate against software bots.

Default value: false

amster attribute: forgottenPasswordCaptchaEnabled
Email Verification: If enabled, users who reset passwords must perform email address verification.

Default value: true

amster attribute: forgottenPasswordEmailVerificationEnabled
Security Questions: If enabled, users must answer their security questions during the forgotten password process.

Default value: false

amster attribute: forgottenPasswordKbaEnabled
Enforce password reset lockout: If enabled, users will be prevented from resetting their password after the configured number of failed attempts.

Default value: false

amster attribute: numberOfAttemptsEnforced
Lock Out After number of attempts: Can be set to 1 or more attempts for a user to correctly answer all their security questions. After the number of configured attempts the user has not correctly answered them the password reset feature will be disabled.

Default value: 1

amster attribute: numberOfAllowedAttempts
Token Lifetime (seconds): Maximum lifetime for the token allowing forgotten password reset, in seconds.

Specify a value from 0 to 2147483647.

Default value: 300

amster attribute: forgottenPasswordTokenTTL
Outgoing Email Subject: Customize the forgotten password email subject text. Format is locale|subject text.

Default value: en|Forgotten password email

amster attribute: forgottenPasswordEmailSubject
Outgoing Email Body: Customize the forgotten password email body text. Format is locale|body text.

Default value: en|<h2>Click on this <a href="%link%">link</a> to reset your password.</h2>

amster attribute: forgottenPasswordEmailBody

Forgotten username

The following settings appear on the Forgotten Username tab:

Forgotten Username: If enabled, users can retrieve their forgotten username.

Default value: false

amster attribute: forgottenUsernameEnabled
Captcha: If enabled, users must pass a Google reCAPTCHA challenge during the forgotten username retrieval process to mitigate against software bots.

Default value: false

amster attribute: forgottenUsernameCaptchaEnabled
Security Questions: If enabled, users must answer their security questions during the forgotten username process.

Default value: false

amster attribute: forgottenUsernameKbaEnabled
Email Username: If enabled, users receive their forgotten username by email.

Default value: true

amster attribute: forgottenUsernameEmailUsernameEnabled
Show Username: If enabled, users see their forgotten username on the browser page.

Default value: false

amster attribute: forgottenUsernameShowUsernameEnabled
Token LifeTime (seconds): Maximum lifetime for the token allowing forgotten username, in seconds.

Default value: 300

amster attribute: forgottenUsernameTokenTTL
Outgoing Email Subject: Customizes the forgotten username email subject text. Format is locale|subject text.

Default value: en|Forgotten username email

amster attribute: forgottenUsernameEmailSubject
Outgoing Email Body: Customizes the forgotten username email body text. Format is locale|body text.

Default value: en|<h2>Your username is <span style="color:blue">%username%</span>.</h2>

amster attribute: forgottenUsernameEmailBody

Profile management

The following settings appear on the Profile Management tab:

Protected Update Attributes

Specifies a profile’s protected user attributes, which causes re-authentication when the user attempts to modify these attributes.

amster attribute: profileProtectedUserAttributes

Self readable attributes

Specifies the list of attributes that users can view when accessing their user profile.

Default value:

uid
telephoneNumber
mail
kbaInfo
givenName
sn
cn

amster attribute: profileAttributeWhitelist

Advanced configuration

The following settings appear on the Advanced Configuration tab:

User Registration Confirmation Email URL: Specifies the confirmation URL that the user receives during the self-registration process. The ${realm} string is replaced with the current realm.

Default value: http://openam.example.com:8080/openam/XUI/?realm=${realm}#register/

amster attribute: userRegistrationConfirmationUrl
Forgotten Password Confirmation Email URL: Specifies the confirmation URL that the user receives after confirming their identity during the forgotten password process. The ${realm} string is replaced with the current realm.

Default value: http://openam.example.com:8080/openam/XUI/?realm=${realm}#passwordReset/

amster attribute: forgottenPasswordConfirmationUrl
User Registration Service Config Provider Class: Specifies the provider class to configure any custom plugins.

Default value: org.forgerock.openam.selfservice.config.flows.UserRegistrationConfigProvider

amster attribute: userRegistrationServiceConfigClass
Forgotten Password Service Config Provider Class: Specifies the provider class to configure any custom plugins.

Default value: org.forgerock.openam.selfservice.config.flows.ForgottenPasswordConfigProvider

amster attribute: forgottenPasswordServiceConfigClass
Forgotten Username Service Config Provider Class: Specifies the provider class to configure any custom plugins.

Default value: org.forgerock.openam.selfservice.config.flows.ForgottenUsernameConfigProvider

amster attribute: forgottenUsernameServiceConfigClass

Self-Service trees

amster service name: SelfServiceTrees

Realm defaults

The following settings appear on the Realm Defaults tab:

Enabled: Default value: true

amster attribute: enabled
Tree Mapping: Maps the self service function name (the key) to an authentication tree (the value).

Default value: {}

amster attribute: treeMapping

Validation service

amster service name: ValidationService

Global attributes

The following settings appear on the Global Attributes tab:

Valid goto URL Resources

List of valid goto URL resources.

Specifies a list of valid URLs for the goto and gotoOnFail query string parameters.

After login or logout, AM can redirect a user to a URL in this list. If the URL is not in this list, AM redirects to the user profile page, the administration console, or the URL set in the Success URL node. If you don’t set this property, AM only allows URLs that match its domain; for example, domain-of-am-instance.com. Use the * wildcard to match all characters except ?.

Examples:

amster attribute: validGotoDestinations

Realm defaults

The following settings appear on the Realm Defaults tab:

Valid goto URL Resources

List of valid goto URL resources.

Specifies a list of valid URLs for the goto and gotoOnFail query string parameters. AM only redirects a user after log in or log out to a URL in this list. If the URL is not in the list, AM redirects to either the user profile page, or the administration console. If this property is not set, AM will only allow URLs that match its domain; for example, domain-of-am-instance.com. Use the * wildcard to match all characters except ?.

Examples:

amster attribute: validGotoDestinations

WebAuthn Metadata service

amster service name: WebAuthnMetadataService

The WebAuthn Metadata service lets you configure how AM obtains FIDO2 metadata.

The service has the following configurable attributes:

Metadata service URIs

The list of locations from which to download the metadata blob.

AM verifies the blob signature against secrets mapped to the am.authentication.nodes.webauthn.fidometadataservice.rootcertificate secret label.

If you don’t want AM to connect to the internet, this location can be a local filesystem.

If you store the metadata blob in a local filesystem, it’s your responsibility to keep it up to date.

amster attribute: fidoMetadataServiceUris

Enforce revocation check

This setting specifies whether AM must check revocation entries from certificates.

The setting is disabled by default, so AM doesn’t check presented certificates for revocation.

If you enable this setting, AM must be able to verify any attestation certificate’s trust chain with a CRL or OCSP entry during processing.

Certificates downloaded from the FIDO Metadata Service might not have a CRL or OCSP entry.

amster attribute: enforceRevocationCheck

WebAuthn Profile Encryption service

amster service name: AuthenticatorWebAuthn

Realm defaults

The following settings appear on the Realm Defaults tab:

Profile Storage Attribute

The user’s attribute in which to store WebAuthn profiles.

The default attribute is added to the schema when you prepare a user store for use with AM. If you want to use a different attribute, you must make sure to add it to your user store schema prior to deploying webauthn with AM. AM must be able to write to the attribute.

Default value: webauthnDeviceProfiles

amster attribute: webauthnAttrName

Device Profile Encryption Scheme

Encryption scheme to use to secure device profiles stored on the server.

The possible values for this property are:

Label: AES-256/HMAC-SHA-512 with RSA Key Wrapping (value: RSAES_AES256CBC_HS512)
Label: AES-128/HMAC-SHA-256 with RSA Key Wrapping (value: RSAES_AES128CBC_HS256)
Label: No encryption of device settings (value: NONE)

Default value: NONE

amster attribute: authenticatorWebAuthnDeviceSettingsEncryptionScheme

Encryption Key Store

Path to the key store from which to load encryption keys.

For greater security, store encryption key information in a secret store, instead of in the configuration. Use the secret label am.services.authenticatorwebauthn.encryption to map an alias for WebAuthn service secrets.

If AM finds a matching secret for the am.services.authenticatorwebauthn.encryption label in a secret store, this value is ignored.

Default value: /path/to/openam/security/keystores/keystore.jceks

amster attribute: authenticatorWebAuthnDeviceSettingsEncryptionKeystore

Key Store Type

Type of key store to load.

PKCS#11 key stores require hardware support such as a security device or smart card and is not available by default in most JVM installations.

Learn more in the JDK 17 PKCS#11 Reference Guide.

If AM finds a matching secret for the am.services.authenticatorwebauthn.encryption label in a secret store, this value is ignored.

The possible values for this property are:

Label: Java Key Store (JKS) (value: JKS)
Label: Java Cryptography Extension Key Store (JCEKS) (value: JCEKS)
Label: PKCS#11 Hardware Crypto Storage (value: PKCS11)
Label: PKCS#12 Key Store (value: PKCS12)

Default value: JCEKS

amster attribute: authenticatorWebAuthnDeviceSettingsEncryptionKeystoreType

Key Store Password

Password to unlock the key store. AM encrypts this password when you save it in the configuration. You should modify the default value.

If AM finds a matching secret for the am.services.authenticatorwebauthn.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorWebAuthnDeviceSettingsEncryptionKeystorePassword

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

If AM finds a matching secret for the am.services.authenticatorwebauthn.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorWebAuthnDeviceSettingsEncryptionKeystoreKeyPairAlias

Private Key Password

Password to unlock the private key.

If AM finds a matching secret for the am.services.authenticatorwebauthn.encryption label in a secret store, this value is ignored.

amster attribute: authenticatorWebAuthnDeviceSettingsEncryptionKeystorePrivateKeyPassword

Ports used

The software uses a number of ports by default:

Default ports used
Port number	Protocol	Description
1689	TCP/IP	Port for Java Management extension (JMX) traffic, disabled by default.
1812	UDP	Port for AM’s RADIUS server, disabled by default.
4444	TCP/IP	Port for the embedded administration connector, enabled by default.
8080	TCP/IP	Web application container port number.
8082	TCP/IP	HTTP port for monitoring AM, disabled by default.
9999	TCP/IP	RMI port for monitoring AM, disabled by default.

Sometimes multiple services are configured on a single system with slightly different port numbers. For example, while the default port number for a servlet container, such as Tomcat, is 8080, a second instance of Tomcat might be configured with a port number of 18080. In all cases shown, communications proceed using the protocol shown in the table.

When you configure a firewall for AM, make sure to include open ports for any installed and related components, including web services (80, 443), servlet containers (8009, 8080, 8443), and external applications.

Additional ports may be used, depending on other components of your deployment. If you are using PingDS, see Administrative access in the DS documentation, for the list of default ports used by DS.

CTS token types

The Core Token Service (CTS) uses a generic LDAP schema for all token types.

The following sections provide information about the different token types, including what LDAP attributes they use, the data stored in those attributes, and example token formats:

OAuth 2.0 grant-set tokens
Client-side OAuth 2.0 tokens
Server-side OAuth 2.0 tokens
Other OAuth 2.0 tokens
SAML 2.0 tokens
Session tokens
Notification tokens

You can use this information to query the CTS using LDAP searches.

For example, if you want to list user OAuth 2.0 refresh tokens, you can filter on coreTokenString03=user and coreTokenString10=refresh_token.

OAuth 2.0 grant-set tokens

OAuth 2.0 grant-set tokens are created when the grant-set scheme is used.

The grant-set acts as a container for all authorizations:

Client-side access code tokens and grant tokens.
Server-side access code tokens, access tokens, and refresh tokens.

LDAP attributes

LDAP attribute OAuth 2.0 grant-set token

coreTokenUserId

coreTokenType

OAUTH2_GRANT_SET

coreTokenString01

coreTokenString02

coreTokenString03

user

coreTokenString04

coreTokenString05

coreTokenString06

coreTokenString07

coreTokenString08

realm

coreTokenString09

client ID

coreTokenString10

coreTokenString11

coreTokenString12

coreTokenString13

coreTokenString14

coreTokenString15

coreTokenString16

coreTokenMultiString03

JSON representation of the OAuth 2.0 grant (access codes, refresh tokens, and access tokens)⁽¹⁾

⁽¹⁾ The following abbreviations are used in this JSON representation:

g: Unique identifier for the grant in the CTS
gx: Grant expiry time
_s: Scope
a: Authorization code
ax: Authorization code expiry time
asi: Journey session ID token
aati: Audit tracking ID
au: Redirect URI
ast: State
_am: Authentication node in AM
_acr: Authentication context class reference, if applicable
gt: Grant type, if applicable

Token examples

Client-side grant-set token

dn: coreTokenId=kOrkxaDZ6fYcUrcE0c3PEMFIGNk,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: frCoreToken
objectClass: top
coreTokenExpirationDate: 20240808152103.155Z
coreTokenId: kOrkxaDZ6fYcUrcE0c3PEMFIGNk
coreTokenMultiString03: {"g":"kOrkxaDZ6fYcUrcE0c3PEMFIGNk.xuPxwKKadXjWvMfKg9WFzvqIOC4","gx":1529062484276,"_s":["openid","profile"],"a":"kOrkxaDZ6fYcUrcE0c3PEMFIGNk.vm6gyeD5t8mF8nTYQ1XQBYTskMo","ax":1528454203638,"aati":"809b87b3-4fad-4ca1-9312-a7f0c669fd6c-34347","ai":true,"au":"https://example.com","asi":"AQIC5w...2NzEz*","ast":"1234","_am":"DataStore","_acr":"0","gt":[]}
coreTokenMultiString03: {"g":"C7mzozs1XJKVvCT63JwQatoI-og.Xf_gOFNZOeGcY6ZLnGxX11N9NKQ","gx":1579098268014,"_s":["read"],"a":"C7mzozs1XJKVvCT63JwQatoI-og.BXUyATQtb9GoyrFvAacc6b20S4A","ax":1578489985511,"aati":"0e4db3cf-14e5-4d44-9f36-8e2fc6ac78a6-15583","ai":true,"an":"123456","au":"https://example.com","asi":"AQIC5w...2NzEz*","ast":"eHI6","_am":"DataStore","_acr":"0","r":"C7mzozs1XJKVvCT63JwQatoI-og.IbiBbTo1bCKelDu4hj5tb_2qbrk","gt":[]}
coreTokenString03: bjensen
coreTokenString08: /myRealm
coreTokenString09: myClient
coreTokenType: OAUTH2_GRANT_SET

bash

Server-side grant-set token

dn: coreTokenId=fx-GTfShtRhmJ89qMNVkxLx339U,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: frCoreToken
objectClass: top
coreTokenExpirationDate: 20240808152103.155Z
coreTokenId: fx-GTfShtRhmJ89qMNVkxLx339U
coreTokenMultiString03: {"g":"fx-GTfShtRhmJ89qMNVkxLx339U.BwOWUGadbho7rKgCYj5Uq1XuRPc","gx":0,"_s":["openid","profile"],"a":"fx-GTfShtRhmJ89qMNVkxLx339U.0g7urZwlwyK_5gUOlC49t4PVUPo","ax":1540546982500,"aati":"fb479915-c2aa-42b3-ad76-b7eb3de950c5-338537161","ai":true,"au":"https://example.com","asi":"AQIC5w...2NzEz*","ast":"1234","_am":"DataStore","_acr":"0","r":"fx-GTfShtRhmJ89qMNVkxLx339U.vXS04FRzuWulPMomSoVDnZvj-6s","rx":1541151662549,"rgt":"authorization_code","rtt":"Bearer","rtn":"refresh_token","rati":"fb479915-c2aa-42b3-ad76-b7eb3de950c5-338537554","ro":"jS474J1xvNZwD-uLeJJeTDWjAzI","_at":1540546862,"_al":0,"gt":[{"t":"fx-GTfShtRhmJ89qMNVkxLx339U.SGEDFJ5BkuuKXKHVeV24_IzoHRg","tx":1540550462814,"tgt":"authorization_code","ts":["openid","profile"],"ttn":"access_token","tati":"fb479915-c2aa-42b3-ad76-b7eb3de950c5-338537841","tck":null}]}
coreTokenString03: bjensen
coreTokenString08: /myRealm
coreTokenString09: myClient
coreTokenType: OAUTH2_GRANT_SET

bash

Client-side OAuth 2.0 tokens

Access code tokens: Client-side access code tokens are created when the one-to-one scheme is used.

They are used in the OAuth 2.0 authorization code flow and in the OIDC authorization code and hybrid flows. They provide the state for the code used by the client to retrieve an access token.

Additionally, the value of the access code is used to form the unique identity of the subsequent grant token.
OAuth 2.0 grant tokens: Client-side OAuth 2.0 grant tokens are created when the one-to-one scheme is used.

They replace individual access and refresh tokens with a single token indicating that a grant took place. This prevents additional data from being written to the CTS when a new access token is issued based on an existing refresh token with an existing grant ID. They use the grant ID value from the preceding access code if this token was generated with the OAuth 2.0 authorization code flow.

The grant ID in the client-side OAuth 2.0 JWT matches the DN of the token in the CTS.

LDAP attributes

LDAP attribute Client-side access code token Client-side OAuth 2.0 grant token

coreTokenUserId

user

coreTokenType

OAUTH

OAUTH2_STATELESS_GRANT

coreTokenString01

scopes

coreTokenString02

coreTokenString03

user

coreTokenString04

redirect_uri

client ID

coreTokenString05

coreTokenString06

true (when the code is used and consent is granted)

scope

coreTokenString07

Bearer

coreTokenString08

realm

coreTokenString09

client ID

coreTokenString10

access_code

coreTokenString11

nonce

realm

coreTokenString12

jti

coreTokenString13

refresh token ID⁽¹⁾

coreTokenString14

coreTokenString15

grant ID

coreTokenString16

coreTokenDate01

grace period end time for refresh token⁽¹⁾

⁽¹⁾ These attributes are only populated when there’s been at least one successful attempt to use a refresh token and the refresh token grace period is enabled.

Token examples

Client-side access code token

dn: coreTokenId=4e915f7a-08ec-4c65-915f-2256d6c3a503,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenObject: {"redirectURI":["https://example.com"],"clientID":["myClient"],"ssoTokenId":["AQIC5w...2NzEz*"],"auditTrackingId":["a7180708-c39b-4f92-90ea-b2b8bb79ec75-83912"],"tokenName":["access_code"],"authModules":[],"code_challenge_method":[],"userName":["bjensen"],"nonce":["abcdef"],"authGrantId":["f58f19f9-7f3f-43db-be90-466643414143"],"acr":[],"expireTime":["1523281431770"],"scope":["openid","profile"],"claims":[null],"realm":["/myRealm"],"id":["4e915f7a-08ec-4c65-915f-2256d6c3a503"],"state":[],"tokenType":["Bearer"],"code_challenge":[],"issued":["true"]}
coreTokenString11: abcdef
coreTokenString01: openid,profile
coreTokenString10: access_code
coreTokenString04: https://example.com
coreTokenString15: f58f19f9-7f3f-43db-be90-466643414143
coreTokenString03: bjensen
coreTokenExpirationDate: 20240808152103.155Z
coreTokenString08: /myRealm
coreTokenString09: myClient
coreTokenId: 4e915f7a-08ec-4c65-915f-2256d6c3a503
coreTokenString06: true
coreTokenString07: Bearer
coreTokenType: OAUTH

bash

Client-side OAuth 2.0 grant token

dn: coreTokenId=f58f19f9-7f3f-43db-be90-466643414143,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenObject: {}
coreTokenString11: /myRealm
coreTokenString04: myClient
coreTokenExpirationDate: 20240808152103.155Z
coreTokenUserId: bjensen
coreTokenId: f58f19f9-7f3f-43db-be90-466643414143
coreTokenString06: openid,profile
coreTokenType: OAUTH2_STATELESS_GRANT

bash

An example access token issued from this CTS grant token:

{
  "sub": "bjensen",
  "auth_level": 0,
  "auditTrackingId": "610b705d-51a9-43e1-b59a-47b372b9d3ae",
  "iss": "https://am.example.com:8443/am/oauth2/myRealm",
  "tokenName": "access_token",
  "token_type": "Bearer",
  "authGrantId": "f58f19f9-7f3f-43db-be90-466643414143",
  "nonce": "abcdef",
  "aud": "myClient",
  "nbf": 1523281312,
  "grant_type": "authorization_code",
  "scope": [
    "openid",
    "profile"
  ],
  "auth_time": 1523281311000,
  "realm": "/myRealm",
  "exp": 1523284912,
  "iat": 1523281312,
  "expires_in": 3600,
  "jti": "c35e5c2a-081b-417f-82c5-2708781816d6"
}

json

Server-side OAuth 2.0 tokens

Access tokens: Server-side OAuth 2.0 access tokens are created when the one-to-one scheme is used.

They are used in all OAuth 2.0 and OIDC flows and are issued when the OAuth 2.0 provider uses server-side tokens.

These tokens are typically short-lived.
Refresh tokens: Server-side OAuth 2.0 refresh tokens are created when the one-to-one scheme is used.

They are used in the OAuth 2.0 authorization code grant and resource owner password credentials flows and in the OIDC authorization code and hybrid flows. They are issued when the OAuth 2.0 provider uses server-side tokens.

These tokens are often long-lived and exchanged for access tokens by clients.

LDAP attributes

LDAP attribute Server-side OAuth 2.0 access token Server-side OAuth 2.0 refresh token

coreTokenUserId

coreTokenType

OAUTH

coreTokenString01

scopes

coreTokenString02

coreTokenString03

user

coreTokenString04

redirect_uri

coreTokenString05

coreTokenString06

coreTokenString07

Bearer

coreTokenString08

realm

coreTokenString09

client ID

coreTokenString10

access_token

refresh_token

coreTokenString11

nonce

coreTokenString12

grant type

coreTokenString13

coreTokenString14

coreTokenString15

grant ID

coreTokenString16

Token examples

Server-side OAuth 2.0 access token

dn: coreTokenId=daaa2a39-ffe9-40a0-b0df-71dc6e278628,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenString11: abcdef
coreTokenObject: {"redirectURI":["https://example.com"],"parent":["cafdd8cc-b155-464a-a020-15013532578c"],"clientID":["myClient"],"auditTrackingId":["ff85ab51-f0b6-48e2-85af-bc26feca5a98-290"],"tokenName":["access_token"],"userName":["bjensen"],"authGrantId":["6f10ad62-1be7-4ebe-aeea-81b7c9eb3735"],"nonce":["abcdef"],"expireTime":["1502145569132"],"grant_type":["authorization_code"],"scope":["openid","profile"],"realm":["/myRealm"],"id":["daaa2a39-ffe9-40a0-b0df-71dc6e278628"],"tokenType":["Bearer"],"refreshToken":["21f89047-4bcf-4d62-853b-d4fa22d632e5"]}
coreTokenString12: authorization_code
coreTokenString01: openid,profile
coreTokenString10: access_token
coreTokenString15: 6f10ad62-1be7-4ebe-aeea-81b7c9eb3735
coreTokenString04: https://example.com
coreTokenString05: 21f89047-4bcf-4d62-853b-d4fa22d632e5
coreTokenString02: cafdd8cc-b155-464a-a020-15013532578c
coreTokenString03: bjensen
coreTokenString08: /myRealm
coreTokenExpirationDate: 20240808152103.155Z
coreTokenString09: myClient
coreTokenId: daaa2a39-ffe9-40a0-b0df-71dc6e278628
coreTokenString07: Bearer
coreTokenType: OAUTH

bash

Server-side OAuth 2.0 refresh token

dn: coreTokenId=21f89047-4bcf-4d62-853b-d4fa22d632e5,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenObject: {"redirectURI":["https://example.com"],"clientID":["myClient"],"auditTrackingId":["ff85ab51-f0b6-48e2-85af-bc26feca5a98-289"],"tokenName":["refresh_token"],"authModules":[],"userName":["bjensen"],"authGrantId":["6f10ad62-1be7-4ebe-aeea-81b7c9eb3735"],"acr":[],"expireTime":["1502746769129"],"grant_type":["authorization_code"],"scope":["openid","profile"],"realm":["/myRealm"],"id":["21f89047-4bcf-4d62-853b-d4fa22d632e5"],"tokenType":["Bearer"]}
coreTokenString12: authorization_code
coreTokenString01: openid,profile
coreTokenString10: refresh_token
coreTokenString15: 6f10ad62-1be7-4ebe-aeea-81b7c9eb3735
coreTokenString04: https://example.com
coreTokenString03: bjensen
coreTokenString08: /myRealm
coreTokenExpirationDate: 20240808152103.155Z
coreTokenString09: MyClient
coreTokenId: 21f89047-4bcf-4d62-853b-d4fa22d632e5
coreTokenString07: Bearer
coreTokenType: OAUTH

bash

Other OAuth 2.0 tokens

OIDC operations (OPS) tokens: OIDC OPS tokens provide a link between the OIDC ID token and the authenticated session that generated it. They contain a copy of the user’s SSO token. This can make the token large when used with a realm that uses client-side sessions.

These tokens are issued by the authorization code and implicit flows when the openid scope is requested, and session management is enabled in the OAuth 2.0 provider. You can disable session management in the OAuth 2.0 provider if you don’t use the endSession and checkSession endpoints; disabling session management reduces the load on the CTS.
OAuth 2.0 device code tokens: OAuth 2.0 device code tokens are used to persist the code in the device code flow. The format is the same whether client-side tokens are used or not, and they are typically short-lived.

LDAP attributes

LDAP attribute OIDC OPS token OAuth 2.0 device code token

coreTokenUserId

coreTokenType

OAUTH

coreTokenString01

scopes

coreTokenString02

coreTokenString03

user

coreTokenString04

coreTokenString05

coreTokenString06

coreTokenString07

coreTokenString08

realm

coreTokenString09

client ID

coreTokenString10

device_code

coreTokenString11

coreTokenString12

coreTokenString13

coreTokenString14

device_code

coreTokenString15

coreTokenString16

Token examples

Server-side session realm OPS token

dn: coreTokenId=c23b5787-ace5-43c4-aeb3-369bbf4e07be,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenObject: {"id":["c23b5787-ace5-43c4-aeb3-369bbf4e07be"],"ops":["AQIC5wM2LY4S...kyNgACUzEAAjAx*"],"expireTime":["1502145569141"]}
coreTokenExpirationDate: 20240808152103.155Z
coreTokenId: c23b5787-ace5-43c4-aeb3-369bbf4e07be
coreTokenType: OAUTH

bash

Client-side session realm OPS token

dn: coreTokenId=938fbe6a-cab6-48fc-ba42-3dbe82af61f3,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenObject: {"id":["938fbe6a-cab6-48fc-ba42-3dbe82af61f3"],"ops":["AQIC5wM2LY4S...PXN0YXRlbGVzc3JlYWx...kyNgACUzEAAjAx*"],"expireTime":["1502145569471"]}
coreTokenExpirationDate: 20240808152103.155Z
coreTokenId: 938fbe6a-cab6-48fc-ba42-3dbe82af61f3
coreTokenType: OAUTH

bash

Device code token

dn: coreTokenId=501905e0-b350-47d5-92cc-161a4291116f,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenObject: {"clientID":["myClient"],"expireTime":["1502142269359"],"user_code":["PDRxhXht"],"auditTrackingId":["ff85ab51-f0b6-48e2-85af-bc26feca5a98-311"],"scope":["profile"],"tokenName":["device_code"],"response_type":["token"],"realm":["/myRealm"],"id":["501905e0-b350-47d5-92cc-161a4291116f"],"userName":["bjensen"],"AUTHORIZED":["true"]}
coreTokenString01: profile
coreTokenString10: device_code
coreTokenString14: PDRxhXht
coreTokenString03: bjensen
coreTokenString08: /myRealm
coreTokenExpirationDate: 20240808152103.155Z
coreTokenString09: myClient
coreTokenId: 501905e0-b350-47d5-92cc-161a4291116f
coreTokenType: OAUTH

bash

SAML 2.0 tokens

SAML 2.0 tokens: SAML 2.0 tokens are only saved to the CTS when SAML 2.0 failover is enabled, which it is by default.
Assertion tokens: Assertions are saved to the CTS when SAML 2.0 failover is enabled, the Assertion Cache is enabled for the IdP, and AM is acting as the IdP.
AuthnRequest tokens: AuthnRequests are saved to the CTS when SAML 2.0 failover is enabled and AM is acting as the SP.

The coreTokenObject can be either JSON or a base64 encoded string.

LDAP attributes

LDAP attribute SAML 2.0 token SAML 2.0 assertion token SAML 2.0 AuthnRequest token

coreTokenUserId

coreTokenType

SAML2

coreTokenString01

com.sun.identity.saml2.profile.IDPSessionCopy

java.lang.String

com.sun.identity.saml2.profile.AuthnRequestInfoCopy

coreTokenString02

coreTokenString03

coreTokenString04

coreTokenString05

coreTokenString06

coreTokenString07

coreTokenString08

coreTokenString09

coreTokenString10

coreTokenString11

coreTokenString12

coreTokenString13

coreTokenString14

coreTokenString15

coreTokenString16

Token examples

SAML 2.0 token

dn: coreTokenId=733237633231656432303961383835626662623039343434653564666532323964366632376466343032,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenId: 733237633231656432303961383835626662623039343434653564666532323964366632376466343032
coreTokenType: SAML2
coreTokenExpirationDate: 20240808152103.155Z
coreTokenObject:: eyJkb0xvZ291dEFsbCI6ZmFsc2UsIm1ldGFBbGlhcyI6Ii9pZHAiLCJuYW1lSURhbmRTUHBhaXJzIjpbeyJuYW1lSUQiOnsiQGNsYXNzIjoiY29tLnN1bi5pZGVudGl0eS5zYW1sMi5hc3NlcnRpb24uaW1wbC5OYW1lSURJbXBsIiwiZm9ybWF0IjoidXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6cGVyc2lzdGVudCIsImlzTXV0YWJsZSI6dHJ1ZSwibmFtZVF1YWxpZmllciI6Imh0dHBzOi8vaWRwLmV4YW1wbGUuY29tOjQ0My9pZHAiLCJzcE5hbWVRdWFsaWZpZXIiOiJodHRwczovL3NwLmV4YW1wbGUuY29tOjg0NDMvc3AiLCJzcFByb3ZpZGVkSUQiOm51bGwsInZhbHVlIjoiK3h4dXQxc3BCR0lWUWJLMDJMbHBNTUhDS1loVyJ9LCJzcEVudGl0eUlEIjoiaHR0cHM6Ly9zcC5leGFtcGxlLmNvbTo4NDQzL3NwIn1dLCJvcmlnaW5hdGluZ0xvZ291dFJlcXVlc3RCaW5kaW5nIjpudWxsLCJvcmlnaW5hdGluZ0xvZ291dFJlcXVlc3RJRCI6bnVsbCwib3JpZ2luYXRpbmdMb2dvdXRTUEVudGl0eUlEIjpudWxsLCJwZW5kaW5nTG9nb3V0UmVxdWVzdElEIjpudWxsLCJzc29Ub2tlbklEIjoiVWxNY0luVlVfR1VnWEdHbTdwTTA0R2h1WHdvLipBQUpUU1FBQ01ETUFBbE5MQUJ4dldYTlNkbTE0U1cxVUszUnpOVkJLVjFwcU5FODJaVGxxYWpnOUFBUjBlWEJsQUFORFZGTUFBbE14QUFJd01nLi4qIn0
coreTokenString01: com.sun.identity.saml2.profile.IDPSessionCopy

bash

If the coreTokenObject is a string, you can base64 decode it. For example, the above string decodes as follows:

{
   "doLogoutAll":false,
   "metaAlias":"/idp",
   "nameIDandSPpairs":[
      {
         "nameID":{
            "@class":"com.sun.identity.saml2.assertion.impl.NameIDImpl",
            "format":"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
            "isMutable":true,
            "nameQualifier":"https://idp.example.com:443/idp",
            "spNameQualifier":"https://sp.example.com:8443/sp",
            "spProvidedID":null,
            "value":"+xxut1spBGIVQbK02LlpMMHCKYhW"
         },
         "spEntityID":"https://sp.example.com:8443/sp"
      }
   ],
   "originatingLogoutRequestBinding":null,
   "originatingLogoutRequestID":null,
   "originatingLogoutSPEntityID":null,
   "pendingLogoutRequestID":null,
   "ssoTokenID":"UlMcInVU_GUgXGGm7pM04GhuXwo.*AAJTSQACMDMAAlNLABxvWXNSdm14SW1UK3RzNVBKV1pqNE82ZTlqajg9AAR0eXBlAANDVFMAAlMxAAIwMg..*"
}

json

Assertion token

dn: coreTokenId=4141514141465630674d52516d69643478435642777932316a714463507a5733566f62703738524a624b36523866755737303567545070624d44453d,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
control: 1.3.6.1.4.1.36733.2.1.5.1 false: bcb3efeb-14a9-47be-8716-9c18918322c8-19593/8
changetype: add
objectClass: frCoreToken
objectClass: top
coreTokenId: 4141514141465630674d52516d69643478435642777932316a714463507a5733566f62703738524a624b36523866755737303567545070624d44453d
coreTokenExpirationDate: 20240808152103.155Z
coreTokenType: SAML2
coreTokenObject: "<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"s2d254cb2c6567979aa293a25d1e0c2c185c976524\" Version=\"2.0\" IssueInstant=\"2024-08-08T14:21:36Z\" Destination=\"https://sp.example.com:8443/am/Consumer/metaAlias/sp\"><saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">IdP</saml:Issuer><samlp:Status xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n<samlp:StatusCode xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\">\n</samlp:StatusCode>\n</samlp:Status><saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" Version=\"2.0\" ID=\"s2f4d9640d71d59c81f145d17cdb738c8ff4d9e5fc\" IssueInstant=\"2024-08-08T14:21:36Z\">\n<saml:Issuer>IdP</saml:Issuer><saml:Subject>\n<saml:NameID NameQualifier=\"IdP\" SPNameQualifier=\"SP\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\">L+OjhuzCtalCRDSox+F3eMcjxjt2</saml:NameID><saml:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\">\n<saml:SubjectConfirmationData NotOnOrAfter=\"2024-08-08T14:21:36Z\" Recipient=\"https://sp.example.com:8443/am/Consumer/metaAlias/sp\" ></saml:SubjectConfirmationData></saml:SubjectConfirmation>\n</saml:Subject><saml:Conditions NotBefore=\"2024-08-08T14:21:36Z\" NotOnOrAfter=\"2024-08-08T14:21:36Z\">\n<saml:AudienceRestriction>\n<saml:Audience>SP</saml:Audience>\n</saml:AudienceRestriction>\n</saml:Conditions>\n<saml:AuthnStatement AuthnInstant=\"2024-08-08T14:21:36Z\" SessionIndex=\"s251a8cdd305404bdf8a4d493860732c2f75842f01\"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>\n</samlp:Response>"
coreTokenString01: java.lang.String

bash

AuthnRequest token

dn: coreTokenId=733230323466363833626637636133316239333932316532616263653035616164656531323931613964,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: frCoreToken
objectClass: top
coreTokenExpirationDate: 20240808152103.155Z
coreTokenId: 733230323466363833626637636133316239333932316532616263653035616164656531323931613964
coreTokenObject: {"authnRequest":"<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"s2024f683bf7ca31b93921e2abce05aadee1291a9d\" Version=\"2.0\" IssueInstant=\"2024-08-08T14:21:36Z\" Destination=\"https://idp.example.com:443/am/SSORedirect/metaAlias/idp\" ForceAuthn=\"false\" IsPassive=\"false\" ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" AssertionConsumerServiceURL=\"https://am.example.com:8443/am/Consumer/metaAlias/sp\">\n<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">https://am.example.com:8443/am</saml:Issuer>\n<samlp:NameIDPolicy xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\" SPNameQualifier=\"https://am.example.com:8443/am\" AllowCreate=\"true\"></samlp:NameIDPolicy>\n<samlp:RequestedAuthnContext xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Comparison=\"exact\"><saml:AuthnContextClassRef xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext>\n</samlp:AuthnRequest>","idpEntityID":"myIdP","paramsMap":{"binding":["HTTP-POST"]},"realm":"/myRealm","relayState":null,"spEntityID":"mySP"}
coreTokenString01: com.sun.identity.saml2.profile.AuthnRequestInfoCopy
coreTokenType: SAML2

bash

Session tokens

Session tokens: The server-side session token is created in the CTS when a user authenticates to a realm configured for server-side sessions. This token allows a user to remain authenticated, even when the AM instance they authenticated to has been shut down.
Session denylist tokens: The client-side session denylist token keeps a record of client-side sessions that were ended by logging out. This token is only created when client-side sessions denylisting is enabled.

LDAP attributes

LDAP attribute Server-side session token Client-side session denylist token

coreTokenUserId

AM internal user DN

coreTokenType

SESSION

SESSION_BLACKLIST

coreTokenString01

server id

coreTokenString02

coreTokenString03

coreTokenString04

coreTokenString05

session token

coreTokenString06

session handle

coreTokenString07

coreTokenString08

coreTokenString09

coreTokenString10

coreTokenString11

realm

coreTokenString12

coreTokenString13

coreTokenString14

coreTokenString15

coreTokenString16

coreTokenMultiString01

listeners

Token examples

Server-side session token

dn: coreTokenId=-8288022266790569769,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenString11: /myRealm
coreTokenObject: {"clientDomain":"dc=example,dc=com","clientID":"id=amadmin,ou=user,dc=example,dc=com",
"cookieMode":true,"cookieStr":null,"creationTimeInMillis":1502229535517,"isSessionUpgrade":false,
"listeners":{"9d16b2e1-50c2-43f8-86ce-97a67be1661a":true,"4bd2e5b4-22c8-4172-a2a6-b9f028e86dc8":true},
"maxCachingTimeInMinutes":3,"maxIdleTimeInMinutes":30,"maxSessionTimeInMinutes":120,"restrictedTokensBySessionID":{},"sessionEventURLs":{},"sessionID":{"comingFromAuth":false,"cookieMode":null,"encryptedString":"AQIC5wM2LY4S...kyNgACUzEAAjAx*","sessionDomain":"dc=example,dc=com","sessionServer":"am.example.com","sessionServerID":"01","sessionServerPort":"8443","sessionServerProtocol":"https","sessionServerURI":"/am"},"sessionProperties":{"Locale":"en","authInstant":"2024-08-08T15:21:03Z","Organization":"dc=example,dc=com","UserProfile":"Required","Principals":"amadmin","successURL":"/am/console","CharSet":"UTF8","Service":"ldapService","Host":"192.0.2.0","cookieSupport":"true","FullLoginURL":"/am/XUI/?realm=%2FmyRealm","AuthLevel":"0","clientType":"genericHTML","AMCtxId":"77a740625b90bc6301","loginURL":"/am/XUI","UserId":"amadmin","AuthType":"DataStore","sun.am.UniversalIdentifier":"id=amadmin,ou=user,dc=example,dc=com","amlbcookie":"01","HostName":"192.0.2.0","Principal":"id=amadmin,ou=user,dc=example,dc=com","UserToken":"amadmin"},"sessionState":"VALID","sessionType":"USER","timedOutTimeInSeconds":0}
coreTokenInteger07: 30
coreTokenString12: 1502229535517
coreTokenInteger06: 120
coreTokenString04: 1502229797863
coreTokenString05: AQIC5wM2LY4S...kyNgACUzEAAjAx*
coreTokenMultiString01: 9d16b2e1-50c2-43f8-86ce-97a67be1661a
coreTokenMultiString01: 4bd2e5b4-22c8-4172-a2a6-b9f028e86dc8
coreTokenExpirationDate: 20240808152103.155Z
coreTokenUserId: id=amadmin,ou=user,dc=example,dc=com
coreTokenId: -8288022266790569769
coreTokenString06: shandle:AQIC5wM2LY4S...kyNgACUzEAAjAx*
coreTokenType: SESSION

bash

Client-side denylist token

dn: coreTokenId=7fac1a04-f358-4ed5-958b-48aac6dd5a34,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: top
objectClass: frCoreToken
coreTokenString01: 01
coreTokenDate01: 20240808142103.155Z
coreTokenExpirationDate:20240808152103.155Z
coreTokenId: 7fac1a04-f358-4ed5-958b-48aac6dd5a34
coreTokenType: SESSION_BLACKLIST

bash

Notification tokens

The notification token provides alerts for session changes, such as when the maximum session time is reached or there is an active logout. This notification system is used by Agents and PingGateway over WebSockets to receive notifications about these session changes.

LDAP attributes

LDAP attribute Notification token

coreTokenUserId

coreTokenType

NOTIFICATION

coreTokenString01

coreTokenString02

coreTokenString03

coreTokenString04

coreTokenString05

coreTokenString06

coreTokenString07

coreTokenString08

coreTokenString09

coreTokenString10

coreTokenString11

coreTokenString12

coreTokenString13

coreTokenString14

coreTokenString15

coreTokenString16

Token example

Notification token

dn: coreTokenId=b66384d2-4792-8bb1-f59f-aa5cff6f2e6c-5460,ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com
objectClass: frCoreToken
objectClass: top
coreTokenExpirationDate: 20240808152103.155Z
coreTokenId: b36284d2-f59f-4692-8bb1-aa5cff6f2e6c-5460
coreTokenObject:: eJyLrlYqyS/ITFayUtJPTE/NK9EvTi0uzszPU9JRSs7PKwGKKFlVK0EFSzNTgAqTjM2MLExSjHTTTC3TdE3MLI10LZKSDHUTE02T09LM0oxSzZJ1TcxNDYBmpJYBTQipLEgF6vPxd/cPDVGqrY0FAOjbJRI=
coreTokenType: NOTIFICATION

bash

Supported standards

AM implements the following RFCs, Internet-Drafts, and standards:

Open Authentication

RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm, supported by the OATH authentication nodes.

RFC 6238: TOTP: Time-Based One-Time Password Algorithm, supported by the OATH authentication nodes.

For more information, refer to Open Authentication.

OAuth 2.0

RFC 6749: The OAuth 2.0 Authorization Framework

RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage

RFC 7009: OAuth 2.0 Token Revocation

RFC 7515: JSON Web Signature (JWS)

RFC 7516: JSON Web Encryption (JWE)

RFC 7517: JSON Web Key (JWK)

RFC 7518: JSON Web Algorithms (JWA)

RFC 7519: JSON Web Token (JWT)

RFC 7522: Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants

RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol

RFC 7636: Proof Key for Code Exchange by OAuth Public Clients

RFC 7662: OAuth 2.0 Token Introspection

RFC 7800: Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)

RFC 8628: OAuth 2.0 Device Authorization Grant

RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

RFC 7592: OAuth 2.0 Dynamic Client Registration Management Protocol

Internet Draft: JWT Response for OAuth Token Introspection

RFC 8693: OAuth 2.0 Token Exchange (Access token to access token, access token to ID token, ID token to ID token, and ID token to access token)

RFC 9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)

RFC 9126: OAuth 2.0 Pushed Authorization Requests

For more information, see OAuth 2.0

OpenID Connect 1.0

OpenID Connect Core 1.0 incorporating errata set 1.

In section 5.6 of this specification, AM supports Normal Claims. AM does not support the optional Aggregated Claims and Distributed Claims representations.

OpenID Connect Client Initiated Backchannel Authentication Flow - Core 1.0 draft-02

AM applies the guidelines suggested by the OpenID Financial-grade API (FAPI) Working Group to the implementation of CIBA, which shapes the support of CIBA in AM.

Implementation Decisions Applying to CIBA Support in AM

AM only supports the CIBA "poll" mode, not the "push" or "ping" modes.
AM requires use of confidential clients for CIBA.
AM requires use of signed JSON-web tokens (JWT) to pass parameters, using one of the following algorithms:
- ES256 - ECDSA with SHA-256 and NIST standard P-256 elliptic curve.
- PS256 - RSASSA-PSS using SHA-256.

Plain JSON or form parameters for CIBA-related data is not supported.

OpenID Connect Discovery 1.0

OpenID Connect Dynamic Client Registration 1.0

OpenID Connect Session Management 1.0 Draft 05

OpenID Connect Session Management 1.0 Draft 10

OAuth 2.0 Multiple Response Type Encoding Practices

OAuth 2.0 Form Post Response Mode

Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)

OpenID Connect Back-Channel Logout 1.0 Draft 06.

AM currently only supports backchannel logout when acting as the provider.

For more information, see:

User-Managed Access (UMA) 2.0

User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization

Federated Authorization for User-Managed Access (UMA) 2.0

Security Assertion Markup Language (SAML) and Federation-related standards

AM supports SAML v2.0, although WS-Federation functionality still creates assertions in SAML v1.x format.

SAML Specifications are available from the OASIS standards page.

Web Services Federation Language (WS-Federation)

Web Services Description Language (WSDL)

eXtensible Access Control Markup Language (XACML)

For more information, see Security Assertion Markup Language (SAML)

Encryption and signatures

Assertion encryption:

aes128-cbc
aes192-cbc
aes256-cbc
tripledes-cbc

Assertion signatures:

rsa-sha1
rsa-sha256
rsa-sha384
rsa-sha512

Query string signatures:

rsa-sha1
rsa-sha256
rsa-sha384
rsa-sha512
ecdsa-sha1
ecdsa-sha256
ecdsa-sha384
ecdsa-sha512

RFC 2898: PKCS #5: Password-Based Cryptography Specification Version 2.0

RFC 3394: Advanced Encryption Standard (AES) Key Wrap Algorithm

RFC 7518: JSON Web Algorithms (JWA)

Federal Information Processing Standard (FIPS) "Security Requirements for Cryptographic Modules"

Other standards

REST

Simple Object Access Protocol (SOAP)

Recommendation E.146, concerning Mobile Subscriber ISDN Numbers (MSISDN), supported for authentication.

RFC 2616: Hypertext Transfer Protocol — HTTP/1.1.

RFC 2617: HTTP Authentication: Basic and Digest Access Authentication, supported for authentication.

RFC 2865: Remote Authentication Dial In User Service (RADIUS), supported as an AM service.

RFC 4510: Lightweight Directory Access Protocol (LDAP), for authentication and when accessing datastores.

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, supported for certificate-based authentication.

RFC 5646: Tags for Identifying Languages.

RFC 5785: Defining Well-Known Uniform Resource Identifiers (URIs).

RFC 6265: HTTP State Management Mechanism regarding HTTP Cookies and Set-Cookie header fields.

RFC 7239: Forwarded HTTP Extension.

Internet-Draft: Password Policy for LDAP Directories (draft 09).

Service endpoints

A service endpoint is an entry point to a web service. This page lists AM service endpoints that are accessible by default.

If you’re certain a particular AM service endpoint isn’t used in your deployment, you can block access to the endpoint.

Learn more in Secure network communication.

JSP files

Some AM JSP pages are directly accessible as service endpoints. The following sections describe the files for those JSP pages. Directory paths in this section are relative to AM’s deployment path, for example, /path/to/tomcat/webapps/am/.

Top-level JSP files

You will find these files in the top-level directory of AM’s deployment path.

Logback.jsp: Provides a page to configure debug logging.

See Debug logging for details.
encode.jsp: Provides a page to encode a cleartext password for use in SAML entity configurations.
getServerInfo.jsp: Supports requests for server information. This page is used internally by AM.
isAlive.jsp: Displays a "Server is ALIVE" message when AM is ready to serve requests.
proxyidpfinder.jsp: Supports access to a remote identity provider through the federation broker.
services.jsp: Lists service configuration information. Use this page when translating configuration changes made in the console into corresponding ssoadm commands.
showServerConfig.jsp: Displays system configuration information, including the deployment URL, OS, Java VM, configuration directory, and more.

User interface JSP files

The JSP files in the com_sun_web_ui/jsp/ directory were used only for the JATO-based UI pages. They weren’t intended to be used directly as external endpoints.

Authentication JSP files

The JSP files in the config/auth/default*/ directories were used only for authentication modules and JATO-based UI pages.

OAuth 2.0 JSP files

The JSP file, oauth2/registerClient.jsp, provides a template page to register an OAuth 2.0 client application without using the main console.

The JSP files in the oauth2c/ directory were used only for authentication modules. They weren’t intended to be used directly as external endpoints.

SAML v2.0 JSP files

The JSP files in the saml2/jsp/ directory provide endpoints used in SAML v2.0 deployments.

Find descriptions for externally useful endpoints in Federate identities.

WS Federation JSP files

The JSP files in the wsfederation/jsp/ directory provide endpoints used in WS-Federation deployments.

WEB-INF URL patterns

The AM .war file includes a deployment descriptor file, WEB-INF/web.xml. The deployment descriptor lists services implemented as servlets, and <url-pattern> elements that map services to AM endpoints.

When protecting an AM server, consider blocking external access to unused services based on their URL patterns.

The web.xml file changes from release to release. If you remove endpoints from this file to disable access to parts of the AM configuration, make sure you review web.xml when you upgrade to a new release of AM. Remove the restricted endpoints and decide whether to disable the new endpoints.

You can find more information about securing your deployment by restricting access to endpoints in How do I remove admin UI access in PingAM and Best practice for blocking the top level realm in a proxy for PingAM.

REST API endpoints

REST API endpoints are discussed in detail as follows:

Authenticate over REST: How to use the AM REST APIs to authenticate to AM.
Policies over REST, Policy sets over REST, Resource types over REST, and Policy set application types over REST: How to use the AM REST APIs for policy management.
Request policy decisions over REST: How to use the AM REST APIs for requesting authorization decisions from AM.
Reset registered devices over REST: How to use the AM REST APIs to reset, or remove a user’s 2FA devices.
OAuth 2.0 endpoints: How to use OAuth 2.0-specific endpoints to request access and refresh tokens, as well as introspecting and revoking them.
OAuth 2.0 administration REST endpoints: How to use AM REST APIs to perform OAuth 2.0 administrative tasks such as registering, reading, and deleting clients.
OpenID Connect 1.0 endpoints: How to use OpenID Connect-specific endpoints to retrieve information about an authenticated user, as well as validate ID tokens and check sessions.
Retrieve forgotten usernames, Reset forgotten passwords, and Register a user: How to use the AM REST APIs for user self-registration and forgotten password reset.
Configure realms over REST: How to use the AM REST APIs for managing AM identities and realms.
Manage scripts (REST): How to use the AM REST APIs to manage AM scripts.
Capture troubleshooting information: How to use the AM REST APIs to record information that can help you troubleshoot AM.
Manage sessions using REST: How to use the AM REST APIs to manage AM sessions.
Consume STS instances and Query, validate, and cancel tokens: How to use the AM REST APIs to manage AM’s Security Token Service, which lets you bridge identities across web and enterprise identity access management (IAM) systems through its token transformation process.

Well-known endpoints

The endpoints described in this section are Well-known URIs supported by AM:

/.well-known/openid-configuration: Exposes OpenID Provider configuration by HTTP GET as specified by OpenID Connect Discovery 1.0. No query string parameters are required.
/uma/.well-known/uma2-configuration: Exposes User-Managed Access (UMA) configuration by HTTP GET as specified by UMA Profile of OAuth 2.0. No query string parameters are required.

Find an example in /uma/.well-known/uma2-configuration.
/.well-known/webfinger: Lets a client retrieve the provider URL for an end user by HTTP GET as specified by OpenID Connect Discovery 1.0.

Find an example in OpenID Connect Discovery.

Glossary

Access control: Control to grant or to deny access to a resource.
Account lockout: The act of making an account temporarily or permanently inactive after successive authentication failures.
Actions: Defined as part of policies, these verbs indicate what authorized identities can do to resources.
Advice: In the context of a policy decision denying access, a hint to the policy enforcement point about remedial action to take that could result in a decision allowing access.
Agent administrator: User having privileges only to read and write agent profile configuration information, typically created to delegate agent profile creation to the user installing a web or Java agent.
Agent authenticator: Entity with read-only access to multiple agent profiles defined in the same realm; allows an agent to read web service profiles.
Application: In general terms, a service exposing protected resources.

In the context of AM policies, the application is a template that constrains the policies that govern access to protected resources. An application can have zero or more policies.
Application type: Application types act as templates for creating policy applications.

Application types define a preset list of actions and functional logic, such as policy lookup and resource comparator logic.

Application types also define the internal normalization, indexing logic, and comparator logic for applications.
Attribute-based access control (ABAC): Access control that is based on attributes of a user, such as how old a user is or whether the user is a paying customer.

Authenticated session: The interval that starts after the user has authenticated and ends when the user logs out or their session is terminated. For browser-based clients, AM manages authenticated sessions across one or more applications by setting a session cookie.

Learn more in server-side sessions and client-side sessions.

A journey session exists before an authenticated session.
Authentication: The act of confirming the identity of a principal.
Authentication level: Positive integer associated with an authentication node, usually used to require success with more stringent authentication measures when requesting resources requiring special protection.
Authorization: The act of determining whether to grant or to deny a principal access to a resource.
Authorization server: In OAuth 2.0, issues access tokens to the client after authenticating a resource owner and confirming that the owner authorizes the client to access the protected resource. AM can play this role in the OAuth 2.0 authorization framework.
Auto-federation: Arrangement to federate a principal’s identity automatically based on a common attribute value shared across the principal’s profiles at different providers.
Bulk federation: Batch job permanently federating user profiles between a service provider and an identity provider based on a list of matched user identifiers that exist on both providers.
Circle of trust: Group of providers, including at least one identity provider, who have agreed to trust each other to participate in a SAML v2.0 provider federation.
Client: In OAuth 2.0, requests protected web resources on behalf of the resource owner given the owner’s authorization. AM can play this role in the OAuth 2.0 authorization framework.

Client-side OAuth 2.0 tokens: After a successful OAuth 2.0 grant flow, AM returns a token to the client. This differs from server-side OAuth 2.0 tokens, where AM returns a reference to token to the client.

Client-side sessions: Sessions for which AM returns session state to the client after each request, and requires the state to be passed in with the subsequent request.

For browser-based clients, AM sets a cookie in the browser that contains the session state. When the browser returns the cookie, AM decodes the session state from the cookie.

A journey session and an authenticated session can be a client-side session.
Conditions: Defined as part of policies, these determine the circumstances under which a policy applies.

Environmental conditions reflect circumstances like the client IP address, time of day, how the subject authenticated, or the authentication level achieved.

Subject conditions reflect characteristics of the subject like whether the subject authenticated, the identity of the subject, or claims in the subject’s JWT.
Configuration datastore: LDAP directory service holding AM configuration data.
Cross-domain single sign-on (CDSSO): AM capability allowing single sign-on across different DNS domains.
Delegation: Granting users administrative privileges with AM.
Entitlement: Decision that defines which resource names can and cannot be accessed for a given identity in the context of a particular application, which actions are allowed and which are denied, and any related advice and attributes.
Extended metadata: Federation configuration information specific to AM.
Extensible Access Control Markup Language (XACML): Standard, XML-based access control policy language, including a processing model for making authorization decisions based on policies.
Federation: Standardized means for aggregating identities, sharing authentication and authorization data information between trusted providers, and allowing principals to access services across different providers without authenticating repeatedly.
Fedlet: Service provider application capable of participating in a circle of trust and allowing federation without installing all of AM on the service provider side; AM lets you create Java Fedlets.
Hot swappable: Refers to configuration properties for which changes can take effect without restarting the container where AM runs.
Identity: Set of data that uniquely describes a person or a thing such as a device or an application.
Identity federation: Linking of a principal’s identity across multiple providers.
Identity provider (IdP): Entity that produces assertions about a principal (such as how and when a principal authenticated, or that the principal’s profile has a specified attribute value).
Identity repository: Data store holding user profiles and group information; different identity repositories can be defined for different realms.
Java agent: Java web application installed in a web container that acts as a policy enforcement point, filtering requests to other applications in the container with policies based on application resource URLs.

Journey session: The interval that starts when the user begins progressing through an authentication journey and ends when the journey completes or the session has timed out.

An authenticated session is created if they authenticate successfully.

A journey session can be a server-side session or a client-side session.
Metadata: Federation configuration information for a provider.
No session tree: Tree that doesn’t result in an authenticated session when it successfully completes.
Policy: Set of rules that define who is granted access to a protected resource when, how, and under what conditions.
Policy agent: Java, web, or custom agent that intercepts requests for resources, directs principals to AM for authentication, and enforces policy decisions from AM.
Policy Administration Point (PAP): Entity that manages and stores policy definitions.
Policy Decision Point (PDP): Entity that evaluates access rights and then issues authorization decisions.
Policy Enforcement Point (PEP): Entity that intercepts a request for a resource and then enforces policy decisions from a PDP.
Policy Information Point (PIP): Entity that provides extra information, such as user profile attributes that a PDP needs to make a decision.

Principal: Represents an entity that has been authenticated (such as a user, a device, or an application), and thus is distinguished from other entities.

When a Subject successfully authenticates, AM associates the Subject with the Principal.
Privilege: In the context of delegated administration, a set of administrative tasks that can be performed by specified identities in a given realm.
Provider federation: Agreement among providers to participate in a circle of trust.
Realm: AM unit for organizing configuration and identity information.

Realms can be used for example when different parts of an organization have different applications and identity stores, and when different organizations use the same AM deployment.

Administrators can delegate realm administration. The administrator assigns administrative privileges to users, allowing them to perform administrative tasks within the realm.
Resource: Something a user can access over the network such as a web page.

Defined as part of policies, these can include wildcards to match multiple actual resources.
Resource owner: In OAuth 2.0, entity who can authorize access to protected web resources, such as an end user.
Resource server: In OAuth 2.0, server hosting protected web resources, capable of handling access tokens to respond to requests for such resources.
Response attributes: Defined as part of policies, these allow AM to return additional information in the form of "attributes" with the response to a policy decision.
Role based access control (RBAC): Access control that is based on whether a user has been granted a set of permissions (a role).
Security Assertion Markup Language (SAML): Standard, XML-based language for exchanging authentication and authorization data between identity providers and service providers.

Server-side OAuth 2.0 tokens: After a successful OAuth 2.0 grant flow, AM returns a reference to the token to the client, rather than the token itself. This differs from client-side OAuth 2.0 tokens, where AM returns the entire token to the client.

Server-side sessions: Sessions that reside in the Core Token Service (CTS) token store. Server-side sessions could also be cached in memory on one or more AM servers. AM tracks these sessions to handle events like logout and timeout, to permit session constraints, and to notify applications involved in SSO when a session ends.

A journey session and an authenticated session can be a server-side session.
Service provider (SP): Entity that consumes assertions about a principal (and provides a service that the principal is trying to access).
Session high availability: Capability that lets any AM server in a clustered deployment access shared, persistent information about users' sessions from the CTS token store. The user does not need to log in again unless the entire deployment goes down.
Session token: Unique identifier issued by AM after successful authentication. For server-side sessions, the session token is used to track a principal’s session.
Single log out (SLO): Capability allowing a principal to end a session once, thereby ending her session across multiple applications.
Single sign-on (SSO): Capability allowing a principal to authenticate once and gain access to multiple applications without authenticating again.
Site: Group of AM servers configured the same way, accessed through a load balancer layer. The load balancer handles failover to provide service-level availability.

The load balancer can also be used to protect AM services.
Standard metadata: Standard federation configuration information that you can share with other access management software.

Stateless service: Stateless services do not store any data locally to the service. When the service requires data to perform any action, it requests it from a datastore. For example, a stateless authentication service stores session state for logged-in users in a database. This way, any server in the deployment can recover the session from the database and service requests for any user.

All AM services are stateless unless otherwise specified. See also client-side sessions and server-side sessions.

Subject: Entity that requests access to a resource

When an identity successfully authenticates, AM associates the identity with the Principal that distinguishes it from other identities. An identity can be associated with multiple principals.
Identity store: Data storage service holding principals' profiles; underlying storage can be an LDAP directory service or a custom IdRepo implementation.
Web Agent: Native library installed in a web server that acts as a policy enforcement point with policies based on web page URLs.

PingAM 8.0.1

Reference

Standards support

Command-line tools

Global configuration reference

Ports used

Name changes for ForgeRock products

Command line tools

ampassword

Description

Options

Examples

amverifyarchive

Description

Options

Examples

configurator.jar

Description

Options

Installation configuration file

Server Properties

Configuration Store Properties

Identity Store Properties

Site Properties

Upgrade Configuration File

Upgrade Properties

Examples

upgrade.jar

Description

Options

Upgrade configuration file

Upgrade properties

Examples

ssoadm

Description

Global options

JVM Properties for ssoadm

Subcommands by category

Agent Configuration

Authentication Service Management

Data Store Management

Entitlements

Federation Management

Identity Management

Policy Management

Realm Management

Server Configuration

Service Management

Other

Subcommands: Alphabetical Order

ssoadm add-agent-to-grp

ssoadm add-amsdk-idrepo-plugin

ssoadm add-app-priv

ssoadm add-attr-defs

ssoadm add-attrs

ssoadm add-auth-cfg-entr

ssoadm add-cot-member

ssoadm add-member

ssoadm add-plugin-interface

ssoadm add-plugin-schema

ssoadm add-privileges

ssoadm add-res-bundle

ssoadm add-site-members

ssoadm add-site-sec-urls

ssoadm add-sub-schema

ssoadm add-svc-attrs

ssoadm add-svc-identity

ssoadm add-svc-realm

ssoadm agent-remove-props

ssoadm clone-server

ssoadm create-agent

ssoadm create-agent-grp

ssoadm create-appl

ssoadm create-appl-type

ssoadm create-auth-cfg

ssoadm create-auth-instance

ssoadm create-cot

ssoadm create-datastore

ssoadm create-identity

ssoadm create-metadata-templ