---
title: CapturedUserPasswordFilter
description: Makes an AM password available to IG in the following steps:
component: pinggateway
version: 7.2
page_id: pinggateway:reference:CapturedUserPasswordFilter
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/CapturedUserPasswordFilter.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-02T16:30:54Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/CapturedUserPasswordFilter.html
section_ids:
  CapturedUserPasswordFilter-usage: Usage
  CapturedUserPasswordFilter-properties: Properties
  CapturedUserPasswordFilter-examples: Examples
  CapturedUserPasswordFilter-moreinfo: More information
---

# CapturedUserPasswordFilter

Makes an AM password available to IG in the following steps:

* Checks for the presence of the SessionInfoContext context, at `${contexts.amSession}`.

  * If the context is not present, or if `sunIdentityUserPassword` is `null`, the CapturedUserPasswordFilter collects session info and properties from AM.

  * If the context is present and `sunIdentityUserPassword` is not `null`, the CapturedUserPasswordFilter uses that value for the password.

* The CapturedUserPasswordFilter decrypts the password and stores it in the CapturedUserPasswordContext, at `${contexts.capturedPassword}`.

## Usage

```json
{
  "name": string,
   "type": "CapturedUserPasswordFilter",
   "config": {
     "amService": AmService reference,
     "keySecretId": configuration expression<secret-id>,
     "keyType": configuration expression<string>,
     "secretsProvider": SecretsProvider reference,
     "ssoToken": runtime expression<string>,
     "key": configuration expression<string> //deprecated
   }
}
```

## Properties

* `"amService"`: *AmService [reference](preface.html#definition-reference), required*

  The AmService heap object to use for the password. See also, [AmService](MiscellaneousConfigurationObjects.html#AmService).

* `"keySecretId"`: *configuration expression<[secret-id](preface.html#definition-enumeration)>, required*

  The secret ID for the key required decrypt the AM password.

* `"keyType"`: *configuration expression<[enumeration](preface.html#definition-enumeration)>, required*

  Algorithm to decrypt the AM password. Use one of the following values:

  * `AES` AES for JWT-based AES_128_CBC_HMAC_SHA_256 encryption. For more information, see [AES_128_CBC_HMAC_SHA_256](https://www.rfc-editor.org/rfc/rfc7518#section-5.2.3) in the IETF *JSON Web Algorithms*.

  * `DES` for DES/ECB/NoPadding

    |   |                                                                                                                                                  |
    | - | ------------------------------------------------------------------------------------------------------------------------------------------------ |
    |   | This value is deprecated, and considered unsecure. For more information, refer to [Deprecation](../release-notes/deprecated-functionality.html). |

- `"secretsProvider"`: *SecretsProvider [reference](preface.html#definition-reference), optional*

  The SecretsProvider object to query for the JWT session signing or encryption keys. For more information, see [SecretsProvider](secrets.html#SecretsProvider).

  Default: The route's default secret service. For more information, see [Default secrets object](secrets.html#default-secrets-object).

- `"ssoToken"`: *runtime expression<[string](preface.html#definition-string)>, required*

  Location of the AM SSO token.

  Default: `${request.cookiesAmService-ssoTokenHeader'][0].value}`, where `AmService-ssoTokenHeader` is the name of the header or cookie where the AmService expects to find SSO tokens.

- `"key"`: *configuration expression\<string>, required*

  |   |                                                                                                                                                                                    |
  | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | This property is deprecated and is not considered secure. Use `keySecretId` instead. For more information, refer to [Deprecation](../release-notes/deprecated-functionality.html). |

  Base64 encoded key value to decrypt the AM password.

## Examples

The following example route is used to get login credentials from AM in [Get login credentials from AM](../gateway-guide/credentials-am.html).

```json
{
  "name": "04-replay",
  "condition": "${find(request.uri.path, '^/replay')}",
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent": {
          "username": "ig_agent",
          "passwordSecretId": "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://am.example.com:8088/openam/"
      }
    },
    {
      "name": "CapturedUserPasswordFilter",
      "type": "CapturedUserPasswordFilter",
      "config": {
        "ssoToken": "${contexts.ssoToken.value}",
        "keySecretId": "aes.key",
        "keyType": "AES",
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "amService": "AmService-1"
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "type": "SingleSignOnFilter",
          "config": {
            "amService": "AmService-1"
          }
        },
        {
          "type": "PasswordReplayFilter",
          "config": {
            "loginPage": "${true}",
            "credentials": "CapturedUserPasswordFilter",
            "request": {
              "method": "POST",
              "uri": "http://app.example.com:8081/login",
              "form": {
                "username": [
                  "${contexts.ssoToken.info.uid}"
                ],
                "password": [
                  "${contexts.capturedPassword.value}"
                ]
              }
            }
          }
        }
      ],
      "handler": "ReverseProxyHandler"
    }
  }
}
```

## More information

[org.forgerock.openig.openam.CapturedUserPasswordFilter](../_attachments/apidocs/org/forgerock/openig/openam/CapturedUserPasswordFilter.html)

[org.forgerock.openig.openam.CapturedUserPasswordContext](../_attachments/apidocs/org/forgerock/openig/openam/CapturedUserPasswordContext.html)

[CapturedUserPasswordContext](RequestsResponsesContexts.html#CapturedUserPasswordContext)

[SessionInfoFilter](Filters.html#SessionInfoFilter)