Configure services

You can configure services globally or per realm. Global services affect all realms in Advanced Identity Cloud. Realm services affect only the realm in which they’re configured.

Global services

Under Native Consoles > Access Management > Configure > Global Services, locate the CORS Service and the Dashboard service.

These services affect all realms in Advanced Identity Cloud.

CORS Service

Configuration

The following settings appear on the Configuration tab:

Enable the CORS filter: If disable, no CORS headers will be added to responses.

Default value: true

Secondary Configurations

This service has the following Secondary Configurations.

configuration

Enable the CORS filter: If disable, no CORS headers will be added to responses.

Default value: false
Accepted Origins: The set of accepted origins.
Accepted Methods: The set of (non-simple) accepted methods, included in the pre-flight response in the header Access-Control-Allow-Methods.
Accepted Headers: The set of (non-simple) accepted headers, included in the pre-flight response in the header Access-Control-Allow-Headers.
Exposed Headers: The set of headers to transmit in the header Access-Control-Expose-Headers.
Max Age: The max age (in seconds) for caching, included in the pre-flight response in the header Access-Control-Max-Age.

Default value: 0
Allow Credentials: Whether to transmit the Access-Control-Allow-Credentials: true header in the response.

Default value: false

Dashboard

Realm Defaults

The following settings appear on the Realm Defaults tab:

Available Dashboard Apps: List of application dashboard names available by default for realms with the Dashboard service configured.

Secondary Configurations

This service has the following Secondary Configurations.

instances

Dashboard Class Name: Identifies how to access the application, for example SAML2ApplicationClass for a SAML 2.0 application.
Dashboard Name: The application name as it will appear to the administrator for configuring the dashboard.
Dashboard Display Name: The application name that displays on the dashboard client.
Dashboard Icon: The icon name that will be displayed on the dashboard client identifying the application.
Dashboard Login: The URL that takes the user to the application.
ICF Identifier: Identifier used by the ForgeRock Identity Connector Framework (ICF).

Realm services

Under Native Consoles > Access Management > Realms > Realm Name > Services, you can enable, remove, or configure services for individual realms.

Android Key Attestation Service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Identity Verification > Android Key Attestation.

Learn more in Android Key Attestation settings.

Base URL Source

The following settings are available in this service:

Base URL Source

Specifies how the base URL is generated.

The following values are supported:

Extension class (EXTENSION_CLASS). This value doesn’t apply to Advanced Identity Cloud.
Fixed value (FIXED_VALUE). The base URL is retrieved from the value specified in the Fixed value base URL field.
Forwarded header (FORWARDED_HEADER). The base URL is retrieved from a forwarded header field in the HTTP request. The Forwarded HTTP header field is standardized and specified in RFC7239.
Host/protocol from incoming request (REQUEST_VALUES). The hostname, server name, and port are retrieved from the incoming HTTP request.
X-Forwarded-* headers (X_FORWARDED_HEADERS). The base URL is retrieved from non-standard header fields, such as X-Forwarded-For, X-Forwarded-By, X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port.

If the X-Forwarded-Proto header is not provided, the server uses a fallback scheme, based on the URI of the request.

If multiple X-Forwarded-Host headers are specified, the outermost proxy host is used.

Default value: REQUEST_VALUES

Cache Manager service

Configuration

Enabled: Enable the Cache Manager Service. If not enabled, entries are computed but never stored, so that each entry is reloaded each time it’s requested.

Learn about using the Cache Manager service in Cache script values.

Default value: Not enabled

Secondary configurations

Configure instances of the Cache Manager service. You can create multiple caches within each realm. The total size for all caches in a realm is limited to 20MB, and each cache entry can’t exceed 5KB.

Loading Script: The script that’s used to load cache entries. The script type must be Cache Loader, and it should have a load() function, and optionally, a reload() function.

Default value: --- Select a script ---

Eviction Policy

The eviction policy used to determine when to remove or reload entries from the cache.

The possible values are as follows:

Expire after access: Entries expire and are removed from the cache after a period of inactivity determined by the Eviction Period. After this time, the cache load() function runs.

Entries remain in the cache indefinitely if they’re continuously accessed within this time.
Expire after write: After the eviction period, entries expire and are removed from the cache. If the cache entry is accessed again, the load() function runs.
Refresh after write: After the eviction period, the reload() function runs.
Never: The cache entry isn’t set to expire.

Default value: Expire after write

Duration Unit

The unit of time for the eviction period. Possible values are Seconds, Minutes, or Hours.

This setting is ignored if the eviction policy is set to Never.

Default value: Hours

Eviction Period

The period of time after which entries are evicted or reloaded from the cache.

This setting is ignored if the eviction policy is set to Never.

Default value: 1

Device ID Service

This service doesn’t apply to Advanced Identity Cloud.

Device Binding service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Authentication Methods > Device Binding.

Learn more in Device binding settings.

Device Profiles Service

The following settings are available in this service:

Profile Storage Attribute

The user’s attribute in which to store Device profiles.

Device Profile Encryption Scheme

Encryption scheme to use to secure device profiles stored on the server.

If enabled, each device profile is encrypted using a unique random secret key using the given strength of AES encryption in CBC mode with PKCS#5 padding. An HMAC-SHA of the given strength (truncated to half-size) is used to ensure integrity protection and authenticated encryption. The unique random key is encrypted with the given RSA key pair and stored with the data.

The possible values for this property are:

AES-256/HMAC-SHA-512 with RSA Key Wrapping
AES-128/HMAC-SHA-256 with RSA Key Wrapping
No encryption of device settings.

Default value: No encryption of device settings.

Encryption Key Store

Path to the key store from which to load encryption keys.

Updating this setting isn’t currently supported in Advanced Identity Cloud. Changing its value may lead to a loss of functionality in this feature.

For greater security, store encryption key information in ESVs, instead of in the configuration. Use the secret label am.services.deviceprofiles.encryption to map an alias for Device Profiles service secrets.

If you update encryption key information in the configuration or in the secret stores, users with existing device profiles will no longer be able to log in using this service. Delete the end user’s device profile so that they can create a new one when they next log in.

If Advanced Identity Cloud finds a matching secret for the am.services.deviceprofiles.encryption label in the realm’s ESV secret store, this value is ignored.

Key Store Type

Type of key store to load.

This property is preconfigured in your Advanced Identity Cloud tenant and shouldn’t be altered.

Default value: Java Key Store (JKS).

Key Store Password

Password to unlock the key store. This password is encrypted when it is saved in the Advanced Identity Cloud configuration.

If Advanced Identity Cloud finds a matching secret for the am.services.deviceprofiles.encryption label in the realm’s ESV secret store, this value is ignored.

Key-Pair Alias

Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

If Advanced Identity Cloud finds a matching secret for the am.services.deviceprofiles.encryption label in the realm’s ESV secret store, this value is ignored.

Private Key Password

Password to unlock the private key.

If Advanced Identity Cloud finds a matching secret for the am.services.deviceprofiles.encryption label in the realm’s ESV secret store, this value is ignored.

Email Service

The openidm binding provides more complete email functionality than the email service. Use openidm to send emails from scripts.

The following settings are available in this service:

Email From Address: Specifies the address from which to send email notifications.

For example, you might set this property to: no-reply@example.com

For Microsoft Graph API transport configurations, this must exist as a valid address in the Microsoft Exchange administration center.
Email Attribute Name: Specifies the profile attribute from which to retrieve the end user’s email address.

Default value: mail
Email Subject: Specifies a subject for notification messages. If you do not set this, Advanced Identity Cloud does not set the subject for notification messages.
Email Content: Specifies content for notification messages. If you do not set this, Advanced Identity Cloud includes only the confirmation URL in the mail body.
Email Rate Limit: Specifies the minimum number of seconds that must elapse between sending emails to an individual user.

Default value: 1
Transport Type: The mail server transport type to use. This value must be set to one of the secondary configurations.

Secondary configurations

This service has the following secondary configurations.

Microsoft Graph API

Email Message Implementation Class: Specifies the class that sends email notifications, such as those sent for user registration and forgotten passwords.

Default value: org.forgerock.openam.services.email.rest.MicrosoftRestMailServer
Email Rest Endpoint URL: Specifies the REST endpoint for sending emails, in the format https://graph.microsoft.com/v1.0/users/USER ID/sendMail.

Refer to the sendMail API reference for details.
OAuth2 Token Endpoint URL: Specifies the endpoint for OAuth 2.0 authentication, in the format https://login.microsoftonline.com/TENANT ID/oauth2/v2.0/token.
OAuth2 Client Id: Specifies the client ID for use in OAuth 2.0 authentication.

This is the client ID or application ID provided by the Microsoft Application Registration portal.
OAuth2 Scopes: Specifies the scopes to request as part of the OAuth 2.0 authentication.

The value supported by Microsoft Graph API is https://graph.microsoft.com/.default.

SMTP

Email Message Implementation Class

Specifies the class that sends email notifications, such as those sent for user registration and forgotten passwords.

Mail Server Host Name

Specifies the fully qualified domain name of the SMTP mail server through which to send email notifications.

For example, you might set this property to: smtp.example.com

Mail Server Host Port

Specifies the port number for the SMTP mail server.

Mail Server Authentication Username

Specifies the username for the SMTP mail server.

For example, you might set this property to: username

Mail Server Authentication Password

Specifies the password for the SMTP username.

Mail Server Secure Connection

Specifies whether to connect to the SMTP mail server using SSL.

The possible values for this property are:

SSL
Non SSL
Start TLS

ForgeRock Authenticator (OATH) Service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Authentication Methods > One-time Passcode (TOTP).

Learn more in One-time passcode (TOTP) settings.

ForgeRock Authenticator (Push) Service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Authentication Methods > Push Authentication.

Learn more in Push authentication settings.

Globalization Settings

The following settings are available in this service:

Auto Generated Common Name Format: Use this list to configure how Advanced Identity Cloud formats names shown in the console banner.

This setting lets you customize the name of the authenticated user shown in the UI, based on the user’s locale.

Http Client service

You can use the Http Client service to send an HTTP request over mTLS from within a script, set timeouts, or route a connection through a proxy server.

Find out how to configure a service instance as the clientName for the httpClient script binding in Send a request using mTLS and Route a request through a proxy.

Realm defaults

The following settings appear on the Realm Defaults tab:

Enabled: Enable this Http Client service to use the secondary configurations when making HTTP requests.

Secondary configurations

This service has the following secondary configurations.

Configuration

Enabled: Enable this Http Client instance.

TLS Configuration

Configure instances of the Http Client service to control how and which certificates Advanced Identity Cloud uses in TLS connections.

Client Certificate Secret Label Identifier

Advanced Identity Cloud uses this identifier to create a specific secret label, using the template am.services.httpclient.mtls.clientcert.identifier.secret where identifier is the value of Client Certificate Secret Label Identifier.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

If this field is empty, the Http Client service doesn’t attach a client certificate to HTTP requests that use mTLS to connect with a target server.

Server Trust Certificates Secret Label Identifier

Advanced Identity Cloud uses this identifier to create a specific secret label, using the template am.services.httpclient.mtls.servertrustcerts.identifier.secret where identifier is the value of Server Trust Certificates Secret Label Identifier.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

If this field is empty, the system truststore is used when attempting to verify the target server’s certificate during a TLS connection.

Disable Certificate Revocation Check

If enabled, Advanced Identity Cloud doesn’t check certificate revocation lists when performing a TLS connection with the target server.

Trust All Certificates

If enabled, all certificates are trusted when performing a TLS connection with the target server.

Don’t enable this setting in a production environment. It is intended for testing purposes only.

Timeouts

Use Instance Timeouts: If enabled, Advanced Identity Cloud uses the connection and response timeouts defined in this Http Client service instance.
Connection Timeout (secs): The maximum time (in seconds) to wait for a connection to be established before failing.

Default value: 10
Response Timeout (secs): The maximum time (in seconds) to wait for a response from the target server before failing.

Default value: 10

Proxy Configuration

Use Instance Proxy: If enabled, Advanced Identity Cloud uses the proxy settings defined in this instance. Otherwise, Advanced Identity Cloud routes HTTP Client requests using the proxy settings defined in your deployment.
Proxy URI: The URI of the proxy server to use for HTTP requests. The format of the URI must be http://hostname:port or https://hostname:port.
Proxy Username: The proxy authentication username, if required.
Proxy Secret Label Identifier: The identifier for the proxy authentication secret.

Advanced Identity Cloud uses this identifier to create a secret label for mapping to a secret in the secret store. The secret label takes the form am.services.httpclient.proxy.identifier.secret, where identifier is the value of Proxy Secret Label Identifier. The label can only contain characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

If this field is empty, Advanced Identity Cloud doesn’t perform proxy authentication.

Identity Assertion service

Configuration

The following settings appear on the Configuration tab:

Enable: Enables the Identity Assertion service that lets Advanced Identity Cloud use PingGateway to manage authentication through a third party such as WDSSO or Kerberos.

When enabled, the servers defined in the secondary configuration become available as options in the Identity Assertion node configuration.
Server cache duration (minutes): Supports caching of identity assertion server configurations. A value greater than 0 indicates the duration in minutes that the server configurations are cached. A value of 0 disables caching.

Secondary configurations

This service has the following secondary configurations.

Identity Assertion server URL: The identity assertion server URL, for example, https://ig.example.com:8448. Don’t include the route in this URL because you define the route when you configure the Identity Assertion node.
Shared Encryption Secret: Advanced Identity Cloud uses this identifier to create a specific secret label, using the template am.services.identityassertion.service.identifier.shared.secret where identifier is the value of Shared Encryption Secret.

The identifier can only contain alphanumeric characters a-z, A-Z, 0-9, and periods (.). It can’t start or end with a period.

The secret is shared by Advanced Identity Cloud and PingGateway to encrypt the assertion request JWT sent to PingGateway and then decrypt the result JWT.

Learn about mapping secrets in Map ESV secrets to secret labels.
JWT TTL (seconds): The identity assertion request JWT time-to-live duration in seconds. This is the period until the JWT sent to the gateway expires.
Skew Allowance (seconds): The time difference skew allowance to use when validating the assertion result JWT’s issued-at and expiry claims. This is to address time differences between the PingGateway host and the AM hosts.

IoT Service

The following settings are available in this service:

Create OAuth 2.0 Client: Create an OAuth 2.0 Client with the given name and default configuration required to serve as the client for the IoT Service. The client will be created without any scope(s).
OAuth 2.0 Client Name: The name of the default OAuth 2.0 Client used by the IoT Service to request access tokens for things.
Create OAuth 2.0 JWT Issuer: Create a Trusted JWT Issuer with the given name and default configuration required for the IoT Service to act as the Issuer when handling request for thing access tokens.
OAuth 2.0 JWT Issuer Name: The name of the Trusted JWT Issuer used by the IoT Service to request access tokens for things.
OAuth 2.0 Subject Attribute: The name of the identity store attribute from which to read the OAuth 2.0 subject value. The subject is used in access tokens issued for things. This allows the thing’s access token subject to have a value other than the thing’s ID, which is the value used by default.
Readable Attributes: Specifies the list of attributes that a thing is allowed to request from its identity.

OAuth 2.0 provider

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authorization > OAuth2 Provider.

Learn more in Configure Advanced Identity Cloud as an authorization server.

OneSpan Configuration

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Identity Verification > OneSpan.

Learn more in OneSpan settings.

PingOne Worker service

Configuration

The following settings appear on the Configuration tab:

Enabled: Enables the service.

Secondary Configurations

This service has the following Secondary Configurations.

The fields you need to configure depend on whether you connect to PingOne using a credential JWT or OIDC client credentials.

Client ID

Client ID of the worker application in PingOne.

Find more information in Adding a worker application for the PingOne Authorize service.

Client Secret Label Identifier

Identifier that Advanced Identity Cloud uses to create a specific secret label for the client secret of the worker application.

The secret label uses the template am.services.pingone.worker.identifier.clientsecret where identifier is the Client Secret Label Identifier value.

This field can only contain characters a-z, A-Z, 0-9, and . and can’t start or end with a period.

Learn how to map the client secret to the secret label in Map ESV secrets to secret labels.

Environment ID

The environment that contains the worker application in PingOne.

PingOne API Server URL

The regional base URL of the PingOne API server.

Enter one of the following:

https://api.pingone.com/v1 - for the North America region (excluding Canada)
https://api.pingone.ca/v1 - for the Canada region
https://api.pingone.eu/v1 - for the European Union region
https://api.pingone.asia/v1 - for the Asia-Pacific region

Default: https://api.pingone.com/v1

PingOne Authorization Server URL

The regional base URL for the PingOne authorization server.

Enter one of the following:

https://auth.pingone.com - for the North America region (excluding Canada)
https://auth.pingone.ca - for the Canada region
https://auth.pingone.eu - for the European Union region
https://auth.pingone.asia - for the Asia-Pacific region

Default: https://auth.pingone.com

Enable Connection via Credential

When enabled, Advanced Identity Cloud uses the details extracted from the PingOne credential JWT to connect to PingOne.

Credential Secret Label Identifier

Identifier that Advanced Identity Cloud uses to create a specific secret label for the credential JWT.

The secret label uses the template am.services.pingone.worker.identifier.credential where identifier is the Credential Secret Label Identifier value.

This field can only contain characters a-z, A-Z, 0-9, and . and can’t start or end with a period.

Learn how to map the credential JWT to the secret label in Map ESV secrets to secret labels.

You can query the configured worker services using the _queryFilter parameter on the realm-config/services/pingOneWorkerService/workers endpoint.

For example, use the following request to return all worker services that are configured to use a credential JWT for connection:

$ curl \
--request GET \
--header 'Accept-API-Version: resource=1.0' \
--header 'Authorization: Bearer <access-token>' \
'https://<tenant-env-fqdn>/am/json/realms/root/realms/alpha/realm-config/services/pingOneWorkerService/workers?_queryFilter=useCredential%20eq%20true'

Test the connection

After you configure the worker service, test the connection from Advanced Identity Cloud to PingOne to verify the details. When you test the connection, Advanced Identity Cloud attempts to get an access token from PingOne using the worker service configuration.

If the connection fails, check the worker service configuration:

Ensure that the ESVs contain the correct values from the worker in the mapped PingOne environment.
Ensure that the ESVs are correctly mapped in the Advanced Identity Cloud service.

There are two ways to test the connection:

In the AM native admin console

Click the Save and Test Connection button to test the connection from Advanced Identity Cloud to PingOne.

A Test Results window indicates whether the connection was successful. It also displays the values used in the connection test, which are extracted from the credential JWT or derived from the worker service configuration, and the reason for failure if the connection was unsuccessful.

Over REST

Use the testConnection action on the realm-config/services/pingOneWorkerService/workers/pingone-worker-service-name endpoint to test the connection from Advanced Identity Cloud to PingOne.

Get an access token that has the fr:am:* scope.

Test the connection from Advanced Identity Cloud to PingOne:

$ curl \
--request POST 'https://<tenant-env-fqdn>/am/json/realms/root/realms/alpha/realm-config/services/pingOneWorkerService/workers/<pingone-worker-service-name>?_action=testConnection' \(1) (2)
--header 'Content-Type: application/json' \
--header 'Accept-API-Version: resource=1.0' \
--header 'Authorization: Bearer <access-token>'(3)

1	Replace <tenant-env-fqdn> with the FQDN of your tenant environment.
2	Replace <pingone-worker-service-name> with the name of the PingOne worker service, ensuring that any spaces are URL encoded. For example, `PingOne%20Worker%20AIC`.
3	Replace <access-token> with the access token created in step 1.

If you get a 200 OK response, the connection is successful. The response includes the values used in the connection test, which are extracted from the credential JWT or derived from the worker service configuration.

Example successful response

The following example response indicates a successful connection test using a credential JWT, with the response including the credentialId (jti claim) and the createdAt timestamp (iat claim) along with the other values extracted from the credential JWT:

{
        "environmentId": "219...43e",
        "apiServerUrl": "https://api.pingone.eu/v1",
        "authServerUrl": "https://auth.pingone.eu",
        "environmentName": "Test Environment",
        "region": "Europe",
        "organizationId": "99f...d1c",
        "organizationName": "My Organization",
        "credentialId": "c0fd...b8e",
        "createdAt": "2026-04-21T17:42:00Z"
    }

If you get a 400 Bad Request response, the connection has failed. The response includes the reason for failure (including an upstream error, if relevant) and the values used in the connection test, if available. These values might be missing if a misconfiguration, such as an invalid credential JWT or an incorrectly mapped ESV, prevents them from being retrieved.

Example unsuccessful response

The following example response indicates an unsuccessful connection test due to invalid client credentials, with the response including the error details from PingOne as well as the values extracted from the credential JWT:

{
    "code": 400,
    "reason": "Bad Request",
    "message": "Failed to retrieve PingOne Worker access token.[Status: 401 Unauthorized]-{\n  \"error\" : \"invalid_client\",\n  \"error_description\" : \"Request denied: Invalid client credentials (Correlation ID: ea883d65-6de5-4906-8109-78516a5214da)\"\n}",
    "detail": {
        "environmentId": "219...43e",
        "apiServerUrl": "https://api.pingone.eu/v1",
        "authServerUrl": "https://auth.pingone.eu",
        "environmentName": "Test Environment",
        "region": "Europe",
        "organizationId": "99f...d1c",
        "organizationName": "My Organization",
        "credentialId": "c0fd...b8e",
        "createdAt": "2026-04-21T17:42:00Z"
    }
}

Policy Configuration

The following settings are available in this service:

Primary LDAP Server

Configuration directory server host:port that Advanced Identity Cloud searches for policy information.

Format: local Advanced Identity Cloud server name | hostname:port

Multiple entries must be prefixed by local server name. Make sure to place the multiple entries on a single line and separate the hostname:port URLs with a space.

For example, am.example.com|ds.example.com:1389 ds.example.com:2389

Default value:

userstore-1.userstore:1389
userstore-0.userstore:1389
userstore-2.userstore:1389

LDAP Users Base DN

Base DN for LDAP Users subject searches.

Default value: ou=identities

LDAP Bind DN

Bind DN to connect to the directory server for policy information.

If you enable mTLS, Advanced Identity Cloud ignores this property.

Default value: &{am.stores.user.username}

LDAP Bind Password

Bind password to connect to the directory server for policy information.

If you enable mTLS, Advanced Identity Cloud ignores this property.

Default value:

{
    "$string": "&{am.stores.user.password}"
}

LDAP Organization Search Filter

Search filter to match organization entries.

Default value: (objectclass=sunismanagedorganization)

LDAP Users Search Filter

Search filter to match user entries.

Default value: (objectclass=inetorgperson)

LDAP Users Search Scope

Search scope to find user entries.

The possible values for this property are:

SCOPE_BASE
SCOPE_ONE
SCOPE_SUB

Default value: SCOPE_SUB

LDAP Users Search Attribute

Naming attribute for user entries.

Default value: uid

Maximum Results Returned from Search

Search limit for LDAP searches.

Default value: 100

Search Timeout

Time after which Advanced Identity Cloud returns an error for an incomplete search, in seconds.

Default value: 5

LDAP SSL/TLS

If enabled, Advanced Identity Cloud connects securely to the directory server. This requires that you install the directory server certificate.

Default value:

{
    "$bool": "&{am.stores.ssl.enabled}"
}

LDAP Connection Pool Minimum Size

Minimum number of connections in the pool.

Default value: 1

LDAP Connection Pool Maximum Size

Maximum number of connections in the pool.

Default value: 10

Heartbeat Interval

Specifies how often should Advanced Identity Cloud send a heartbeat request to the directory.

Use this option in case a firewall/loadbalancer can close idle connections, since the heartbeat requests will ensure that the connections won’t become idle.

Default value: 10

Heartbeat Unit

Defines the time unit corresponding to the Heartbeat Interval setting.

Use this option in case a firewall/loadbalancer can close idle connections, since the heartbeat requests will ensure that the connections won’t become idle.

The possible values for this property are:

Label: second (Value: SECONDS)
Label: minute (Value: MINUTES)
Label: hour (Value: HOURS)

Default value: SECONDS

Subjects Result Time to Live

Maximum time that Advanced Identity Cloud caches a subject result for evaluating policy requests, in minutes. A value of 0 prevents Advanced Identity Cloud from caching subject evaluations for policy decisions.

Default value: 10

User Alias

If enabled, Advanced Identity Cloud can evaluate policy for remote users aliased to local users.

Default value: false

Check resources exist when Resource Server is updated

Check all registered resources exist when updating the Resource Server.

When enabled, the Policy Set checks registered Resource Types one by one against the configuration store. Consider disabling this option if you have many Resource Types registered to a Policy Set.

Default value: true

mTLS Enabled

Enables mutual TLS (mTLS) authentication between Advanced Identity Cloud and this data store.

When you enable mTLS, you must also:

Enable LDAP SSL/TLS.
Map the secret label am.policy.configuration.serice.mtls.cert to the alias you want to use for mTLS authentication to this store.

Advanced Identity Cloud ignores the LDAP Bind DN and LDAP Bind Password when you enable mTLS.

Push Notification Service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Authentication Methods > Push Notification Delivery.

Learn more in Push notification delivery settings.

Remote Consent Service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authorization > Remote Consent Service.

Learn more in Remote consent service.

Self Service Trees

This service is now configured in the Advanced Identity Cloud admin console. To configure this service, go to Authenication > Self-service journeys.

Learn more in Self-service journeys.

Session

Dynamic Attributes

The following settings appear on the Dynamic Attributes tab:

Maximum Session Time: Maximum time a session can remain valid before Advanced Identity Cloud requires the user to authenticate again, in minutes.

Default value: 120
Maximum Idle Time: Maximum time a server-side session can remain idle before Advanced Identity Cloud requires the user to authenticate again, in minutes.

Default value: 30
Maximum Caching Time: Maximum duration that external clients should cache the session, in minutes.

Default value: 3
Active User Sessions: Maximum number of concurrent server-side authenticated sessions Advanced Identity Cloud allows a user to have.

Default value: 5

Session Property Whitelist Service

The following settings are available in this service:

Allowlisted Session Property Names

A list of properties that users may read, edit the value of, or delete from their session.

Adding properties to sessions can affect Advanced Identity Cloud’s performance because there is no size constraint limiting the set of properties you can add to sessions and no limit on the number of session properties you can add.

Protected attributes can’t be set, edited, or deleted, even if they are included in this allowlist.

Session Properties to return for session queries

A list of session properties that can be returned to admins in a REST session query response.

This setting can impact REST query performance. When session properties are added, the CTS token must be retrieved, and can be decrypted and decompressed, if configured.

Protected attributes can’t be set, edited or deleted, even if they are included in this list.

Social Authentication Implementations

This service doesn’t apply to Advanced Identity Cloud.

Social Identity Provider Service

This service is now configured in the Advanced Identity Cloud admin console. To configure this service, go to Integrations > Identity Providers.

Learn more in Social authentication.

Transaction Authentication Service

The following settings are available in this service:

Time to Live: The number of seconds within which the transaction must be completed.

User

Dynamic Attributes

The following settings appear on the Dynamic Attributes tab:

User Preferred Timezone

Time zone for accessing the UI.

Administrator DN Starting View

Specifies the DN for the initial screen when an administrator successfully logs in to the UI.

Default User Status

Inactive users cannot authenticate, though Advanced Identity Cloud stores their profiles.

The possible values for this property are:

Active
Inactive

Validation Service

The following settings are available in this service:

Valid goto URL Resources

List of valid goto URL resources.

Specifies a list of valid URLs for the goto and gotoOnFail query string parameters.

After login or logout, Advanced Identity Cloud can redirect a user to a URL in this list. If the URL is not in this list, Advanced Identity Cloud redirects to the user profile page or the URL set in the Success URL node. If you don’t set this property, Advanced Identity Cloud only allows URLs that match its domain. Use the * wildcard to match all characters except ?.

Examples:

http://app.example.com:80/*
http://app.example.com:80/*?*

WebAuthn Profile Encryption Service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Authentication Methods > WebAuthn storage & encryption service.

Learn more in WebAuthn storage & encryption settings.

WebAuthn Metadata service

You now configure these settings in the Advanced Identity Cloud admin console. To do this, go to Authentication > Authentication Methods > WebAuthn Verification.

Learn more in WebAuthn verification settings.

PingOne Advanced Identity Cloud

Configure services

Global services

CORS Service

Configuration

Secondary Configurations

configuration

Dashboard

Realm Defaults

Secondary Configurations

instances

Realm services

Android Key Attestation Service

Base URL Source

Cache Manager service

Configuration

Secondary configurations

Device ID Service

Device Binding service

Device Profiles Service

Email Service

Secondary configurations

Microsoft Graph API

SMTP

ForgeRock Authenticator (OATH) Service

ForgeRock Authenticator (Push) Service

Globalization Settings

Http Client service

Realm defaults

Secondary configurations

Configuration

TLS Configuration

Timeouts

Proxy Configuration

Identity Assertion service

Configuration

Secondary configurations

IoT Service

OAuth 2.0 provider

OneSpan Configuration

PingOne Worker service

Configuration

Secondary Configurations

Test the connection

Policy Configuration

Push Notification Service

Remote Consent Service

Self Service Trees

Session

Dynamic Attributes

Session Property Whitelist Service

Social Authentication Implementations

Social Identity Provider Service

Transaction Authentication Service

User

Dynamic Attributes

Validation Service

WebAuthn Profile Encryption Service

WebAuthn Metadata service