--- title: Contexts description: The root object for request context information. component: pinggateway version: 2023.11 page_id: pinggateway:reference:Contexts canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/Contexts.html llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2025-06-03T11:21:31Z superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/Contexts.html section_ids: contexts-summary: Summary of contexts Attributes: AttributesContext Attributes-properties: Properties Attributes-moreinfo: More information AuthRedirectContext: AuthRedirectContext AuthRedirectContext-properties: Properties AuthRedirectContext-moreinfo: More information CapturedUserPasswordContext: CapturedUserPasswordContext CapturedUserPasswordContext-properties: Properties CapturedUserPasswordContext-moreinfo: More information CdSsoContext: CdSsoContext CdSsoContext-properties: Properties CdSsoContext-moreinfo: More information CdSsoFailureContext: CdSsoFailureContext CdSsoFailureContext-properties: Properties CdSsoFailureContext-moreinfo: More information Client: ClientContext Client-properties: Properties Client-moreinfo: More information IdpSelectionLoginContext: IdpSelectionLoginContext properties: Properties JwtBuilderContext: JwtBuilderContext JwtBuilderContext-properties: Properties JwtBuilderContext-moreinfo: More information JwtValidationContext: JwtValidationContext JwtValidationContext-properties: Properties JwtValidationContext-moreinfo: More information JwtValidationErrorContext: JwtValidationErrorContext JwtValidationErrorContext-properties: Properties JwtValidationErrorContext-moreinfo: More information OAuth2Context: OAuth2Context OAuth2Context-properties: Properties OAuth2Context-moreinfo: More information OAuth2TokenExchangeContext: OAuth2TokenExchangeContext OAuth2TokenExchangeContext-properties: Properties OAuth2TokenExchangeContext-moreinfo: More information OAuth2FailureContext: OAuth2FailureContext OAuth2FailureContext-properties: Properties OAuth2FailureContext-examples: Examples OAuth2FailureContext-moreinfo: More information PolicyDecisionContext: PolicyDecisionContext PolicyDecisionContext-properties: Properties PolicyDecisionContext-moreinfo: More information Session: SessionContext Session-properties: Properties Session-moreinfo: More information SessionInfoContext: SessionInfoContext SessionInfoContext-properties: Properties SessionInfoContext-moreinfo: More information SsoTokenContext: SsoTokenContext SsoTokenContext-properties: Properties SsoTokenContext-moreinfo: More information StsContext: StsContext StsContext-properties: Properties StsContext-moreinfo: More information UriRouterContext: UriRouterContext UriRouterContext-properties: Properties UriRouterContext-moreinfo: More information UserProfileContext: UserProfileContext UserProfileContext-propeties: Properties UserProfileContext-moreinfo: More information TransactionIdContext: TransactionIdContext TransactionIdContext-properties: Properties TransactionIdContext-moreinfo: More information --- # Contexts The root object for request context information. Contexts is a map of available contexts, which implement the [Context](../_attachments/apidocs/org/forgerock/services/context/Context.html) interface. The `contexts` map is populated dynamically when creating bindings to evaluate expressions and scripts. If a context type appears multiple times in the chain of contexts, only the last value of the context is exposed in the contexts map. For example, if a route contains two JwtBuilderFilters that each provided data in the JwtBuilderContext, only data from the last processed JwtBuilderFilter is contained in `${contexts.jwtBuilder}`. Data from the first processed JwtBuilderFilter can be accessed by scripts and extensions through the `Context` API. The following example script accesses data from the first processed JwtBuilderFilter: ```bash Context second = context.get("jwtBuilder") .map(Context::getParent) .flatMap(ctx -> ctx.get("jwtBuilder")) .orElse(null); ``` The map keys are strings and the values are context objects. All context objects use their version of the following properties: * `"context-Name"`: string Context name. * `"context-ID"`: string Read-only string uniquely identifying the context object. * `"context-rootContext"`: boolean True if the context object is a RootContext (has no parent). * `"context-Parent"`: Context object Parent of this context object. Contexts provide contextual information to downstream filters and handlers about a handled request. The context can include information about the client making the request, the session, the authentication or authorization identity of the user, and any other state information associated with the request. Contexts provide a way to access state information throughout the duration of the HTTP session between the client and protected application. Interaction with additional services can also be captured in the context. Filters can enrich existing contexts (store objects in sessions or attributes), or by provide new contexts tailored for a purpose. Therefore, the list of available context is dynamic and depends on which filters have been executed when a context is queried. For example, a context can be queried by a script, at startup, or at runtime. Unlike session information, which spans multiple request/response exchanges, contexts last only for the duration of the request/response exchange, and are then lost. ## Summary of contexts | Type | Accessible at | Populated by | Contains | | ----------------------------------------------------------- | ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | [AttributesContext](#Attributes) | `contexts.attributes.attributes` and `attributes` | IG core, when a request enters IG | Map of request attributes for use by filters at different positions in the chain | | [AuthRedirectContext](#AuthRedirectContext) | `${contexts.AuthRedirectContext}` | [FragmentFilter](Filters.html#FragmentFilter) and [DataPreservationFilter](Filters.html#DataPreservationFilter) | Indication to the FragmentFilter and DataPreservationFilter that a login redirect is pending | | [CapturedUserPasswordContext](#CapturedUserPasswordContext) | `${contexts.capturedPassword}` | [CapturedUserPasswordFilter](Filters.html#CapturedUserPasswordFilter) | Decrypted AM password of the current user | | [CdSsoContext](#CdSsoContext) | `${contexts.cdsso}` | [CrossDomainSingleSignOnFilter](Filters.html#CrossDomainSingleSignOnFilter) | CDSSO token properties, session user ID, full claims set. | | [CdSsoFailureContext](#CdSsoFailureContext) | `${contexts.cdssoFailure}` | [CrossDomainSingleSignOnFilter](Filters.html#CrossDomainSingleSignOnFilter) | Information about errors occurring during CDSSO authentication | | [ClientContext](#Client) | `${contexts.client}` | IG core, when a request enters IG | Information about the client sending the request, and the client certificate if using mTLS | | [IdpSelectionLoginContext](#IdpSelectionLoginContext) | `${contexts.idpSelectionLogin}` | [AuthorizationCodeOAuth2ClientFilter](Filters.html#AuthorizationCodeOAuth2ClientFilter) when `loginHandler` is specified. | The original target URI for a request received by IG. | | [JwtBuilderContext](#JwtBuilderContext) | `${contexts.jwtBuilder}` | [JwtBuilderFilter](Filters.html#JwtBuilderFilter) | Built JWT as string, JsonValue, or map | | [JwtValidationContext](#JwtValidationContext) | `${contexts.jwtValidation}` | [JwtValidationFilter](Filters.html#JwtValidationFilter) and [IdTokenValidationFilter](Filters.html#IdTokenValidationFilter) | Properties of a JWT after validatedation | | [JwtValidationErrorContext](#JwtValidationErrorContext) | `${contexts.jwtValidationError}` | [JwtValidationFilter](Filters.html#JwtValidationFilter) and [IdTokenValidationFilter](Filters.html#IdTokenValidationFilter) | Properties of a JWT after validation fails | | [OAuth2Context](#OAuth2Context) | `${contexts.oauth2}` | [OAuth2ResourceServerFilter](Filters.html#OAuth2ResourceServerFilter) | Properties of an OAuth 2.0 access token after validation | | [OAuth2TokenExchangeContext](#OAuth2TokenExchangeContext) | `${contexts.oauth2TokenExchange}` | [OAuth2TokenExchangeFilter](Filters.html#OAuth2TokenExchangeFilter) | Issued token and its scopes | | [OAuth2FailureContext](#OAuth2FailureContext) | `${contexts.oauth2failure}` | [AuthorizationCodeOAuth2ClientFilter](Filters.html#AuthorizationCodeOAuth2ClientFilter) and [OAuth2TokenExchangeFilter](Filters.html#OAuth2TokenExchangeFilter) | OAuth 2.0 authorization operation error and error description | | [PolicyDecisionContext](#PolicyDecisionContext) | `${contexts.policyDecision}` | [PolicyEnforcementFilter](Filters.html#PolicyEnforcementFilter) | Attributes and advices returned by AM policy decisions | | [SessionContext](#Session) | `${contexts.session}` | IG core, when a request enters IG | Information about stateful and stateless sessions | | [SessionInfoContext](#SessionInfoContext) | `${contexts.amSession}` | [SessionInfoFilter](Filters.html#SessionInfoFilter) | AM session information and properties | | [SsoTokenContext](#SsoTokenContext) | `${contexts.ssoToken}` | [SingleSignOnFilter](Filters.html#SingleSignOnFilter) and [CrossDomainSingleSignOnFilter](Filters.html#CrossDomainSingleSignOnFilter) | SSO tokens and their validation information | | [StsContext](#StsContext) | `${contexts.sts}` | [TokenTransformationFilter](Filters.html#TokenTransformationFilter) | Result of a token transformation | | [TransactionIdContext](#TransactionIdContext) | `${contexts.transactionId}` | IG core, when a request enters IG | ForgeRock transaction ID of a request | | [UriRouterContext](#UriRouterContext) | `${contexts.router}` | IG core, when a request traverses a route | Routing information associated with a request | | [UserProfileContext](#UserProfileContext) | `${contexts.userProfile}` | [UserProfileFilter](Filters.html#UserProfileFilter) | User profile information | ## AttributesContext Provides a map for request attributes. When IG processes a single request, it injects transient state information about the request into this context. Attributes stored when processing one request are not accessible when processing a subsequent request. IG automatically provides access to the `attributes` field through the `attributes` bindings in expressions. For example, to access a username with an expression, use `${attributes.credentials.username}` instead of `${contexts.attributes.attributes.credentials.username}` Use [SessionContext](#Session) to maintain state between successive requests from the same logical client. ### Properties The context is named `attributes`, and is accessible at `${attributes}`. The context has the following property: * `"attributes"`: [map](preface.html#definition-map) Map with the format `Map`, where: * Key: Attribute name * Value: Attribute value Cannot be null. ### More information [org.forgerock.services.context.AttributesContext](../_attachments/apidocs/org/forgerock/services/context/AttributesContext.html) ## AuthRedirectContext Used by the following filters to indicate that a login redirect is pending: * [FragmentFilter](Filters.html#FragmentFilter) * [DataPreservationFilter](Filters.html#DataPreservationFilter) This context is not intended for use in scripts or extensions. For a single request there must be at most one instance of AuthRedirectContext in the context hierarchy. Confirm for the presence of an AuthRedirectContext before adding a new instance or adding query parameters to an existing instance. The context is named `AuthRedirectAwareContext`, and is accessible at `${contexts.AuthRedirectContext}`. ### Properties * `"impendingIgRedirectNotified"`: *boolean* Returns `true` if an IG redirect attempt is pending. Otherwise, returns `false`. * `"notifyImpendingIgRedirectAndUpdateUri"`: *URI* Notifies that an IG redirection has been attempted, and returns an updated URI as follows: * If no query parameters are added to the context, return the original URI. * If query parameters are added to the context, apply them to the URI and return an updated URI. * If the added query parameters have the same name as existing query parameters, replace the existing parameters and return an updated URI. For example, a request to `example.com/profile` triggers a login redirect to `example.com/login`. After authentication, the request is expected to be redirected to the original URI, `example.com/profile`. * `"addQueryParameter"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Adds a query parameter to the context, for use by `notifyImpendingIgRedirectAndUpdateUri`. ### More information [org.forgerock.openig.filter.AuthRedirectContext](../_attachments/apidocs/org/forgerock/openig/filter/AuthRedirectContext.html) ## CapturedUserPasswordContext Provides the decrypted AM password of the current user. When the [CapturedUserPasswordFilter](Filters.html#CapturedUserPasswordFilter) processes a request, it injects the decrypted password from AM into this context. ### Properties The context is named `capturedPassword`, and is accessible at `${contexts.capturedPassword}`. The context has the following properties: * `"raw"`: *byte* The decrypted password as bytes. * `"value"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The decrypted password as a UTF-8 string. ### More information [org.forgerock.openig.openam.CapturedUserPasswordContext](../_attachments/apidocs/org/forgerock/openig/openam/CapturedUserPasswordContext.html) ## CdSsoContext Provides the cross-domain SSO properties for the CDSSO token, the user ID of the session, and the full claims set. When the [CrossDomainSingleSignOnFilter](Filters.html#CrossDomainSingleSignOnFilter) processes a request, it injects the information in this context. ### Properties The context is named `cdsso`, and is accessible at `${contexts.cdsso}`. The context has the following properties: * `"claimsSet"`: *[org.forgerock.json.jose.jwt.JwtClaimsSet](../_attachments/apidocs/org/forgerock/json/jose/jwt/JwtClaimsSet.html)* Full JwtClaimsSet for the identity of the authenticated user. Cannot be null. Access claims as follows: * Claims with a getter by using the property name. For example, access `getSubject` with `contexts.cdsso.claimsSet.subject`. * All other claims by using the `getClaim` method. For example, access `subname` with `contexts.cdsso.claimsSet.getClaim('subname')`. * `"cookieInfo"`: *org.forgerock.openig.http.CookieBuilder* Configuration data for the CDSSO authentication cookie, with the following attributes: * `name`: Cookie name (string) * `domain`: (Optional) Cookie domain (string) * `path`: Cookie path (string) No attribute can be null. * `"redirectEndpoint"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Redirect endpoint URI configured for communication with AM. Cannot be null. * `"sessionUid"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Universal session ID. Cannot be null. * `"token"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Value of the CDSSO token. Cannot be null. ### More information [org.forgerock.openig.openam.CdSsoContext](../_attachments/apidocs/org/forgerock/openig/openam/CdSsoContext.html) ## CdSsoFailureContext Contains the error details for any error that occurred during cross-domain SSO authentication. When the [CrossDomainSingleSignOnFilter](Filters.html#CrossDomainSingleSignOnFilter) processes a request, should an error occur that prevents authentication, the error details are captured in this context. ### Properties The context is named `cdssoFailure`, and is accessible at `${contexts.cdssoFailure}`. The context has the following properties: * `"error"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The error that occurred during authentication. Cannot be null. * `"description"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* A description of the error that occurred during authentication. Cannot be null. * `"throwable"`: *[java.lang.Throwable](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/Throwable.html)* Any `Throwable` associated with the error that occured during authentication. Can be null. ### More information [org.forgerock.openig.openam.CdSsoFailureContext](../_attachments/apidocs/org/forgerock/openig/openam/CdSsoFailureContext.html) ## ClientContext Information about the client sending a request. When IG receives a request, it injects information about the client sending the request into this context. ### Properties The context is named `client`, and is accessible at `${contexts.client}`. The context has the following properties: * `"certificates"`: *[java.util.List](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/List.html) <[java.security.cert.Certificate](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/security/cert/Certificate.html)>* List of X.509 certificates presented by the client. If the client does not present any certificates, IG returns an empty list. Never `null`. The following example uses the certificate associated with the incoming HTTP connection: ```json { "name": "CertificateThumbprintFilter-1", "type": "CertificateThumbprintFilter", "config": { "certificate": "${contexts.client.certificates[0]}" } } ``` * `"isExternal"`: *boolean* True if the client connection is external. * `"isSecure"`: *boolean* True if the client connection is secure. * `"localAddress"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The IP address of the interface that received the request. * `"localPort"`: *integer* The port of the interface that received the request. * `"remoteAddress"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The IP address of the client (or the last proxy) that sent the request. * `"remotePort"`: *integer* The source port of the client (or the last proxy) that sent the request. * `"remoteUser"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The login of the user making the request, or `null` if unknown. This is likely to be `null` unless you have deployed IG with a non-default deployment descriptor that secures the IG web application. * `"userAgent"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The value of the User-Agent HTTP header in the request if any, otherwise `null`. ### More information [org.forgerock.services.context.ClientContext](../_attachments/apidocs/org/forgerock/services/context/ClientContext.html) ## IdpSelectionLoginContext Provides the original target URI for the request received by IG. Use this context with `loginHandler` in [AuthorizationCodeOAuth2ClientFilter](Filters.html#AuthorizationCodeOAuth2ClientFilter). ### Properties The context is named `idpSelectionLogin` and is accessible at `${contexts.idpSelectionLogin}`. The context has the following property: * `"originalUri"`: *[URI](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/URI.html)* The original target URI for the request received by IG. The value of this field is read-only. ## JwtBuilderContext When the [JwtBuilderFilter](Filters.html#JwtBuilderFilter) processes a request, it stores provided data in this context. This context returns the JWT as string, JsonValue, or map for downstream use. ### Properties The context is named `jwtBuilder`, and is accessible at `${contexts.jwtBuilder}`, with the following properties: * `"value"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The base64url encoded UTF-8 parts of the JWT, containing name-value pairs of data. Cannot be null. * `"claims"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* Map with the format `Map`, where: * Key: Claim name * Value: Claim value * `"claimsAsJsonValue"`: *[org.forgerock.json.JsonValue](../_attachments/apidocs/org/forgerock/json/JsonValue.html)* Claims as a JSon value. ### More information [org.forgerock.openig.filter.JwtBuilderFilter](../_attachments/apidocs/org/forgerock/openig/filter/JwtBuilderFilter.html) [org.forgerock.openig.filter.JwtBuilderContext](../_attachments/apidocs/org/forgerock/openig/filter/JwtBuilderContext.html) ## JwtValidationContext Provides the properties of a JWT after validation. When the [JwtValidationFilter](Filters.html#JwtValidationFilter) validates a JWT, or the [IdTokenValidationFilter](Filters.html#IdTokenValidationFilter) validates an id_token, it injects a copy of the JWT and its claims into this context. ### Properties The context is named `jwtValidation`, and is accessible at `${contexts.jwtValidation}`. The context has the following properties: * `"value"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The value of the JWT. Cannot be null. * `"claims"`: *[org.forgerock.json.jose.jwt.JwtClaimsSet](../_attachments/apidocs/org/forgerock/json/jose/jwt/JwtClaimsSet.html)* A copy of the claims as a JwtClaimsSet. * `"info"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map in the format `Map`, where: * Key: Claim name * Value: Claim value * `"jwt"`: *[org.forgerock.json.jose.jwt.Jwt](../_attachments/apidocs/org/forgerock/json/jose/jwt/Jwt.html)* A copy of the JWT. ### More information [org.forgerock.openig.filter.jwt.JwtValidationFilter](../_attachments/apidocs/org/forgerock/openig/filter/jwt/JwtValidationFilter.html) [org.forgerock.openig.filter.oauth2.client.IdTokenValidationFilterHeaplet](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/client/IdTokenValidationFilterHeaplet.html) [org.forgerock.openig.filter.jwt.JwtValidationContext](../_attachments/apidocs/org/forgerock/openig/filter/jwt/JwtValidationContext.html) [org.forgerock.openig.filter.jwt.JwtValidationErrorContext](../_attachments/apidocs/org/forgerock/openig/filter/jwt/JwtValidationErrorContext.html) ## JwtValidationErrorContext Provides the properties of a JWT after validation fails. When the [JwtValidationFilter](Filters.html#JwtValidationFilter) fails to validate a JWT, or the [IdTokenValidationFilter](Filters.html#IdTokenValidationFilter) fails to validate an id_token, it injects the JWT and a list of violations into this context. ### Properties The context is named `jwtValidationError`, and is accessible at `${contexts.jwtValidationError}`. The context has the following properties: * `"jwt"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The value of the JWT. Cannot be null. * `"violations"`: *[java.util.List](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/List.html)<[Violation](../_attachments/apidocs/org/forgerock/openig/tools/jwt/validation/Violation.html)>* A list of violations. ### More information [org.forgerock.openig.filter.jwt.JwtValidationFilter](../_attachments/apidocs/org/forgerock/openig/filter/jwt/JwtValidationFilter.html) [org.forgerock.openig.filter.oauth2.client.IdTokenValidationFilterHeaplet](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/client/IdTokenValidationFilterHeaplet.html) [org.forgerock.openig.filter.jwt.JwtValidationContext](../_attachments/apidocs/org/forgerock/openig/filter/jwt/JwtValidationContext.html) [org.forgerock.openig.filter.jwt.JwtValidationErrorContext](../_attachments/apidocs/org/forgerock/openig/filter/jwt/JwtValidationErrorContext.html) ## OAuth2Context Provides OAuth 2.0 access tokens. When the [OAuth2ResourceServerFilter](Filters.html#OAuth2ResourceServerFilter) processes a request, it injects the access token into this context. ### Properties The context name is `oauth2`, and is accessible at `${contexts.oauth2}`. The context has the following properties: * `"accessToken"`: *[org.forgerock.http.oauth2.AccessTokenInfo](../_attachments/apidocs/org/forgerock/http/oauth2/AccessTokenInfo.html)* The AccessTokenInfo is built from the following properties: * `"info"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map`, where * Key: Claim name * Value: Claim value in raw JSON * `"token"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Access token identifier issued from the Authorization Server. * `"scopes"`: *[java.util.Set](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Set.html)* A set scopes associated to this token, with the format `Set`. * `"expiresAt"`: *[java.lang.Long](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/Long.html)* Timestamp of when the token expires, in milliseconds since epoch. ### More information [org.forgerock.http.oauth2.OAuth2Context](../_attachments/apidocs/org/forgerock/http/oauth2/OAuth2Context.html) [org.forgerock.http.oauth2.AccessTokenInfo](../_attachments/apidocs/org/forgerock/http/oauth2/AccessTokenInfo.html) ## OAuth2TokenExchangeContext When the [OAuth2TokenExchangeFilter](Filters.html#OAuth2TokenExchangeFilter) succesfully issues a token, it injects the issued token and its scopes into this context. ### Properties The context name is `OAuth2TokenExchangeContext`, and is accessible at `${contexts.oauth2TokenExchange}`. The context has the following properties: * `"issuedToken"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The token issued by the Authorization Server. * `"issuedTokenType"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The token type URN. * `"scopes"`: *[java.util.Set](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Set.html)<[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)>* One or more scopes associated with the issued token, for example, `"scope1", "scope2", "scope3"`. * `"rawInfo"`: *[org.forgerock.json.JsonValue](../_attachments/apidocs/org/forgerock/json/JsonValue.html)* The raw token info as issued by the Authorization Server. ### More information [org.forgerock.openig.filter.oauth2.OAuth2TokenExchangeContext](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/OAuth2TokenExchangeContext.html) [OAuth2FailureContext](#OAuth2FailureContext) [OAuth2TokenExchangeFilter](Filters.html#OAuth2TokenExchangeFilter) [RFC 6749: Error Response](https://www.rfc-editor.org/rfc/rfc6749#section-5.2) ## OAuth2FailureContext When an OAuth 2.0 authorization operation fails, the error and error description provided by the authorization service are injected into this context for use downstream. The amount and type of information in the context depends on when a failure occurs. This context is created by [AuthorizationCodeOAuth2ClientFilter](Filters.html#AuthorizationCodeOAuth2ClientFilter) and [OAuth2TokenExchangeFilter](Filters.html#OAuth2TokenExchangeFilter). This context supports OAuth 2.0 error messages in the format given by [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2). ### Properties The context is named `OAuth2Failure`, and is accessible at `${contexts.oauth2failure}`. The context has the following properties: * `"error"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The error field name. * `"description"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Error description field name. * `"exception"`: *[org.forgerock.openig.filter.oauth2.client.OAuth2ErrorException](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/client/OAuth2ErrorException.html)* The OAuth 2.0 exception associated with the token exchange error. ### Examples For examples that use `${contexts.oauth2failure.error}` and `${contexts.oauth2failure.description`, refer to the routes in [OAuth 2.0 token exchange](../gateway-guide/token-transformation.html#token-exchange) and [Discover and dynamically register with OpenID Connect providers](../gateway-guide/oidc.html#oidc-discovery). ### More information [org.forgerock.openig.filter.oauth2.OAuth2FailureContext](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/OAuth2FailureContext.html) [OAuth2TokenExchangeContext](#OAuth2TokenExchangeContext) [OAuth2TokenExchangeFilter](Filters.html#OAuth2TokenExchangeFilter) [RFC 6749: Error Response](https://www.rfc-editor.org/rfc/rfc6749#section-5.2) ## PolicyDecisionContext Provides attributes and advices returned by AM policy decisions. When the [PolicyEnforcementFilter](Filters.html#PolicyEnforcementFilter) processes a request, it injects the attributes and advices into this context. ### Properties The context is named `policyDecision`, and is accessible at `${contexts.policyDecision}`. The context has the following properties: * `"attributes"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map>`, where: * Key: Attribute name. * Value: A One or more attribute values provided in the policy decision. Can be empty, but not null. * `"jsonAttributes"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map>`, where: * Key: Attribute name. * Value: One or more attribute values provided in the policy decision. Can be empty, but not null. * `"advices"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map>`, where: * Key: Advice name. * Value: One or more advice values provided in the policy decision. Can be empty, but not null. * `"jsonAdvices"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map>`, where: * Key: Advice name * Value: One or more advice values provided in the policy decision. Can be empty, but not null. * `"actions"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map` where: * Key: Action name. * Value: `true` when an action is allowed for the specified resource, `false` otherwise. Cannot be null. * `"jsonActions"`: *[json.JsonValue](../_attachments/apidocs/org/forgerock/json/JsonValue.html)* A map with the format `Map`, where: * Key: Action name. * Value: `true` when an action is allowed for the specified resource, `false` otherwise. Cannot be null. * `"resource"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The resource value used in the policy request. Can be empty, but not null. ### More information [org.forgerock.openig.openam.PolicyDecisionContext.html](../_attachments/apidocs/org/forgerock/openig/openam/PolicyDecisionContext.html) ## SessionContext Provides access to information about stateful and stateless sessions. To process a single request, consider using [AttributesContext](#Attributes) to transfer transient state between components and prevent IG from creating additional sessions. IG automatically provides access to the `session` field through the `session` bindings in expressions. For example, to access a username with an expression, use `${session.username}` instead of `${contexts.session.session.username}` ### Properties The context is named `session`, and is accessible at `${contexts.session}`. The context has the following properties: * `"session"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map`, where: * Key: Session property name * Value: Session property value Any object type can be stored in the session. ### More information [org.forgerock.http.session.SessionContext](../_attachments/apidocs/org/forgerock/http/session/SessionContext.html) ## SessionInfoContext Provides AM session information and properties. When the [SessionInfoFilter](Filters.html#SessionInfoFilter) processes a request, it injects info and properties from the AM session into this context. ### Properties The context is named `amSession`, and is accessible at `${contexts.amSession}`. The context has the following properties: * `"asJsonValue()"`: *[json.JsonValue](../_attachments/apidocs/org/forgerock/json/JsonValue.html)* Raw JSON. * `"latestAccessTime"`: *[java.time.Instant](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Instant.html)* The timestamp of when the session was last used. Can be null if the DN is not resident on the SSO token, or if the time cannot be obtained from the session. * `"maxIdleExpirationTime"`: *[java.time.Instant](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Instant.html)* The timestamp of when the session would time out for inactivity. Can be null if the DN is not resident on the SSO token, or if the time cannot be obtained from the session. * `"maxSessionExpirationTime"`: *[java.time.Instant](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Instant.html)* The timestamp of when the session would time out regardless of activity. Can be null if the DN is not resident on the SSO token, or if the time cannot be obtained from the session. * `"properties"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A read-only map with the format `Map`, where * Key: Name of a property bound to the session * Value: Value of the property The following properties are retrieved: * When `sessionProperties` in AmService is configured, listed session properties with a value. * When `sessionProperties` in AmService is not configured, all session properties with a value. * Properties with a value that are required by IG but not specified by `sessionProperties` in AmService. For example, when the session cache is enabled, session properties related to the cache are automatically retrieved. Properties with a value are returned, properties with a null value are not returned Can be empty, but not null. * `"realm"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The realm as specified by AM, in a user-friendly slash (/) separated format. Can be null if the DN is not resident on the SSO token. * `"sessionHandle"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The handle to use for logging out of the session. Can be null if the handle is not available for the session. * `"universalId"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The DN that AM uses to uniquely identify the user. Can be null if it cannot be obtained from the SSO token. * `"username"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* A user-friendly version of the username. Can be null if the DN is not resident on the SSO token, or empty if it cannot be obtained from the DN. ### More information [org.forgerock.openig.openam.SessionInfoContext](../_attachments/apidocs/org/forgerock/openig/openam/SessionInfoContext.html) ## SsoTokenContext Provides SSO tokens and their validation information. When the [SingleSignOnFilter](Filters.html#SingleSignOnFilter) or [CrossDomainSingleSignOnFilter](Filters.html#CrossDomainSingleSignOnFilter) processes a request, it injects the value of the SSO token and additional information in this context. ### Properties The context is named `ssoToken`, and is accessible at `${contexts.ssoToken}`. The context has the following properties: * `"info"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map`, where * Key: Property bound to the SSO token, such as `realm` or `uid` * Value: Value of the property Information associated with the SSO token, such as `realm` or `uid`. Cannot be null. * `"loginEndpoint"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* A string representing the URL of the login endpoint, evaluated from the configuration of SingleSignOnFilter. * `"value"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The value of the SSO token. Cannot be null. ### More information [org.forgerock.openig.openam.SsoTokenContext](../_attachments/apidocs/org/forgerock/openig/openam/SsoTokenContext.html) ## StsContext Provides the result of a token transformation. When the [TokenTransformationFilter](Filters.html#TokenTransformationFilter) processes a request, it injects the result into this context. ### Properties The context is named `sts`, and is accessible at `${contexts.sts}`. The context has the following properties: * `"issuedToken"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The result of the token transformation. ### More information [org.forgerock.openig.openam.StsContext](../_attachments/apidocs/org/forgerock/openig/openam/StsContext.html) ## UriRouterContext Provides routing information associated with a request. When IG routes a request, it injects information about the routing into this context. ### Properties The context is named `router`, and is accessible at `${contexts.router}`. The context has the following properties: * `"baseUri"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The portion of the request URI which has been routed so far. * `"matchedUri"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The portion of the request URI that matched the URI template. * `"originalUri"`: *[URI](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/URI.html)* The original target URI for the request, as received by IG. The value of this field is read-only. * `"remainingUri"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* The portion of the request URI that is remaining to be matched. * `"uriTemplateVariables"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* A map with the format `Map`, where: * Key: Name of a URI template variable * Value: Value of a URI template variable ### More information [org.forgerock.http.routing.UriRouterContext](../_attachments/apidocs/org/forgerock/http/routing/UriRouterContext.html) ## UserProfileContext When the [UserProfileFilter](Filters.html#UserProfileFilter) processes a request, it injects the user profile information into this context. This context provides raw JSON representation, and convenience accessors that map commonly used LDAP field names to a context names. ### Properties The context is named `userProfile`, and is accessible at `${contexts.userProfile}`. The context has the following properties: * `"username"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* User-friendly version of the username. This field is always fetched. If the underlying data store doesn't include `username`, this field is null. Example of use: `${contexts.userProfile.username}` * `"realm"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Realm as specified by AM, in a user-friendly slash (/) separated format. Can be null. Example of use: `${contexts.userProfile.realm}` * `"distinguishedName"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Distinguished name of the user. Can be null. Example of use: `${contexts.userProfile.distinguishedName}` * `"commonName"`: *[java.lang.String](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html)* Common name of the user. Can be null. Example of use: `${contexts.userProfile.commonName}` * `"rawInfo"`: *[java.util.Map](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Map.html)* An unmodifiable map in the format `Map`, where: * Key: Name of a field in an AM user profile * Value: Value of a field in an AM user profile This context contains the object structure of the AM user profile. Any individual field can be retrieved from the map. Depending on the requested fields, the context can be empty or values can be null. Examples of use: `${contexts.userProfile.rawInfo}`, `${contexts.userProfile.rawInfo.username}`, `${contexts.userProfile.rawInfo.employeeNumber[0]}`. * `"asJsonValue()"`: [json.JsonValue](../_attachments/apidocs/org/forgerock/json/JsonValue.html) User profile information structured as JSON. Example of use: `${contexts.userProfile.asJsonValue()}` ### More information [org.forgerock.openig.openam.UserProfileContext](../_attachments/apidocs/org/forgerock/openig/openam/UserProfileContext.html) [UserProfileFilter](Filters.html#UserProfileFilter) ## TransactionIdContext The transaction ID of a request. When IG receives a request, it injects the transaction ID into this context. ### Properties The context is named `transactionId`, and is accessible at `${contexts.transactionId}`. The context has the following properties: * `"transactionId"`: *[org.forgerock.services.TransactionId](../_attachments/apidocs/org/forgerock/services/TransactionId.html)* The ID of the transaction. ### More information [org.forgerock.services.TransactionIdContext](../_attachments/apidocs/org/forgerock/services/TransactionId.html) [org.forgerock.services.context.TransactionIdContext](../_attachments/apidocs/org/forgerock/services/context/TransactionIdContext.html)