---
title: CapturedUserPasswordFilter
description: Makes an AM password available to IG in the following steps:
component: pinggateway
version: 2023.11
page_id: pinggateway:reference:CapturedUserPasswordFilter
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/CapturedUserPasswordFilter.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-03T11:21:31Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/CapturedUserPasswordFilter.html
section_ids:
  CapturedUserPasswordFilter-usage: Usage
  CapturedUserPasswordFilter-properties: Properties
  CapturedUserPasswordFilter-examples: Examples
  CapturedUserPasswordFilter-moreinfo: More information
---

# CapturedUserPasswordFilter

Makes an AM password available to IG in the following steps:

* Checks for the presence of the SessionInfoContext context, at `${contexts.amSession}`.

  * If the context is not present, or if `sunIdentityUserPassword` is `null`, the CapturedUserPasswordFilter collects session info and properties from AM.

  * If the context is present and `sunIdentityUserPassword` is not `null`, the CapturedUserPasswordFilter uses that value for the password.

* The CapturedUserPasswordFilter decrypts the password and stores it in the CapturedUserPasswordContext, at `${contexts.capturedPassword}`.

## Usage

```json
{
  "name": string,
   "type": "CapturedUserPasswordFilter",
   "config": {
     "amService": AmService reference,
     "keySecretId": configuration expression<secret-id>,
     "keyType": configuration expression<string>,
     "secretsProvider": SecretsProvider reference,
     "ssoToken": runtime expression<string>,
     "key": configuration expression<string> //deprecated
   }
}
```

## Properties

* `"amService"`: *AmService [reference](preface.html#definition-reference), required*

  The AmService heap object to use for the password. See also, [AmService](MiscellaneousConfigurationObjects.html#AmService).

* `"keySecretId"`: *configuration expression<[secret-id](preface.html#definition-enumeration)>, required*

  The secret ID for the key required decrypt the AM password.

  This secret ID must point to a [CryptoKey\`](../security-guide/keys.html#secret-types) that matches the algorithm in `"keyType"`.

  |   |                                                                                                                                                                                                                                                           |
  | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | Although secrets of type `GenericSecret` are accepted, their usage is deprecated in this filter. For more information, refer to the [Deprecated](https://docs.pingidentity.com/pinggateway/release-notes/deprecated.html) section of the *Release Notes*. |

* `"keyType"`: *configuration expression<[enumeration](preface.html#definition-enumeration)>, required*

  Algorithm to decrypt the AM password. Use one of the following values:

  * `AES` AES for JWT-based AES_128_CBC_HMAC_SHA_256 encryption. For more information, refer to [AES_128_CBC_HMAC_SHA_256](https://www.rfc-editor.org/rfc/rfc7518#section-5.2.3) in the IETF *JSON Web Algorithms*.

  * `DES` for DES/ECB/NoPadding

    |   |                                                                                                                                                                                                             |
    | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    |   | This value is deprecated, and considered unsecure. For more information, refer to the [Deprecated](https://docs.pingidentity.com/pinggateway/release-notes/deprecated.html) section of the *Release Notes*. |

* `"secretsProvider"`: *SecretsProvider [reference](preface.html#definition-reference), optional*

  The SecretsProvider object to query for the shared secret that is used to decrypt the user password.

  For more information, refer to [SecretsProvider](secrets.html#SecretsProvider).

* `"ssoToken"`: *runtime expression<[string](preface.html#definition-string)>, required*

  Location of the AM SSO token.

  Default: `${request.cookiesAmService-ssoTokenHeader'][0].value}`, where `AmService-ssoTokenHeader` is the name of the header or cookie where the AmService expects to find SSO tokens.

* `"key"`: *configuration expression\<string>, required*

  |   |                                                                                                                                                                                                                                               |
  | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | This property is deprecated and is not considered secure. Use `keySecretId` instead. For more information, refer to the [Deprecated](https://docs.pingidentity.com/pinggateway/release-notes/deprecated.html) section of the *Release Notes*. |

  Base64 encoded key value to decrypt the AM password.

## Examples

The following example route is used to get login credentials from AM in [Authenticate with credentials from AM](../gateway-guide/sso-cdsso.html#credentials-am).

```json
{
  "name": "04-replay",
  "condition": "${find(request.uri.path, '^/replay')}",
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore",
      "config": {
        "mappings": [
          {
            "secretId": "aes.key",
            "format": {
              "type": "SecretKeyPropertyFormat",
              "config": {
                "format": "BASE64",
                "algorithm": "AES"
              }
            }
          }
        ]
      }
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent": {
          "username": "ig_agent",
          "passwordSecretId": "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://am.example.com:8088/openam/"
      }
    },
    {
      "name": "CapturedUserPasswordFilter",
      "type": "CapturedUserPasswordFilter",
      "config": {
        "ssoToken": "${contexts.ssoToken.value}",
        "keySecretId": "aes.key",
        "keyType": "AES",
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "amService": "AmService-1"
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "type": "SingleSignOnFilter",
          "config": {
            "amService": "AmService-1"
          }
        },
        {
          "type": "PasswordReplayFilter",
          "config": {
            "loginPage": "${true}",
            "credentials": "CapturedUserPasswordFilter",
            "request": {
              "method": "POST",
              "uri": "http://app.example.com:8081/login",
              "form": {
                "username": [
                  "${contexts.ssoToken.info.uid}"
                ],
                "password": [
                  "${contexts.capturedPassword.value}"
                ]
              }
            }
          }
        }
      ],
      "handler": "ReverseProxyHandler"
    }
  }
}
```

## More information

[org.forgerock.openig.openam.CapturedUserPasswordFilter](../_attachments/apidocs/org/forgerock/openig/openam/CapturedUserPasswordFilter.html)

[org.forgerock.openig.openam.CapturedUserPasswordContext](../_attachments/apidocs/org/forgerock/openig/openam/CapturedUserPasswordContext.html)

[CapturedUserPasswordContext](Contexts.html#CapturedUserPasswordContext)

[SessionInfoFilter](Filters.html#SessionInfoFilter)