Deployment configuration

File that contains the path to the AM configuration folder. By default, the .openamcfg directory is created in the home directory of the user that runs the web container. For example, /usr/local/.openamcfg/AMConfig_usr_local_apache-tomcat-8.0.35_webapps_openam_.

The backend type for the embedded DS server.

Properly URL encode session tokens.

Modules for which to open daemons at AM startup.

Whether to connect to the configuration directory server over LDAPS.

AM Configuration and log file location.

When using JSS or JSSE, check whether the name values in the SubjectAltName certificate match the server FQDN.

When using JSS or JSSE, check that the IP address of the server resolves to the host name.

When using JSS or JSSE, comma-separated list of server FQDNs to trust if they match the certificate CN, even if the domain name isn’t correct.

When using JSS or JSSE, set to true to trust whatever certificate is presented without checking.

Used with sticky load balancers that can inspect the cookie value.

Persistent cookie name.

Not used

Not used

Enables caching for configuration data and user data.

Time in minutes after which a web or Java agent’s server-side session expires. Note that this setting is ignored when AM creates a client-side session for a web or Java agent.

Whether client applications such as web or Java agents poll for server-side session changes. If false, then client applications register listeners for notifications about changes to server-side sessions.

If client applications poll for changes, number of seconds between polls.

Create an HttpSession for users on successful authentication.

SSL socket factory implementation used by AM.

Replication port for the embedded DS server.

This property applies to multi-server AM deployments that use the embedded DS store.

Whether to check for cookie support in the user agent, and if not to return an error.

Whether to append the session cookie to URL for a zero page session.

Cookie used by the AM authentication service to handle the authentication process.

Set the name of the HTTP header that AM can examine to learn the client IP address when requests go through a proxy or load balancer. (When requests go through an HTTP proxy or load balancer, checking the IP address on the request alone returns the address of the proxy or load balancer rather than that of the client.) AM must be able to trust the proxy or load balancer to set the client IP address correctly in the header specified.

Whether to allow users to open many browser tabs to the login page at the same time without encountering an error.

Whether to allow multiple cookie domains.

List of special users always authenticated against the local directory server.

Identifies an administrative user that replaces the amAdmin user. For example, uid=superroot,ou=people,dc=example,dc=com.

When cookie hijacking protection is configured, name of the cookie holding the URL to the AM server that authenticated the user.

Notification service endpoint for clients such as web and Java agents.

Number of threads in the shared system timer pool used to schedule operations such as session timeout.

When set to true, mark cookies as HTTPOnly to prevent scripts and third-party programs from accessing the cookies.

Configures support for applying SameSite cookie rules, as per internet-draft Cookies:HTTP State Management Mechanism.

If true, then AM is using protection against cookie hijacking.

Whether JSS should take priority over other providers.

Whether monitoring is active for AM.

URL for local connection to the monitoring service.

Internal property used by AM.

Weights of the cost of evaluating policy subjects, rules, and conditions. Evaluation is in order of heaviest weight to lightest weight.

Maximum number of policy decisions AM caches.

Whether to perform a Java security permissions check for AM.

Enables virtual hosts, partial hostname and IP address. Maps invalid or virtual name keys to valid FQDN values for proper redirection.

For additional compression of CTS token JSON binaries, beyond GZip, if desired.

For GZip-based compression of CTS tokens, if desired.

Enables tokens to be encrypted when stored.

Enables service configuration caching.

When service configuration caching time-to-live is enabled, this sets the time to live in minutes.

If service configuration caching is enabled, whether to enable a time-to-live for cached configuration.

File system directory to hold file-based representation of AM configuration.

Class used to read and write AM service configuration entries in the directory.

Used to set the read timeout in milliseconds for HTTP and HTTPS connections to other servers.

Whether to perform an HTTP GET on com.sun.identity.urlchecker.targeturl as a health check against another server in the same site.

URL to monitor when com.sun.identity.urlchecker.dorequest is set to true.

Whether to cache documents for HTTP and HTTPS connections to other servers.

Name of the web container to correctly set character encoding, if necessary.

Used to assigned privileged console access to particular users. Set to a | separated list of users' Universal IDs, such as console.privileged.users=uid=demo,ou=user,dc=openam,dc=forgerock,dc=org|uid=demo2,ou=user,dc=openam,dc=forgerock,dc=org.

Where to destroy the old session after a session is successfully upgraded.

Cookie used by the AM distributed authentication service to handle the authentication process.

Class that controls which session properties are copied during session upgrade, where default is to copy all properties to the upgraded session.

The X-DSAMEVersion http header provides detailed information about the version of AM currently running on the system, including the build and date/time of the build. AM will need to be restarted once this property is enabled.

Whether to ignore the goto query string parameter on logout, instead displaying the logout page.

Character set used for globalization.

Comma-separated list of HTTP headers not to copy when the distributed authentication server forwards a request to another distributed authentication server.

Comma-separated list of HTTP headers not to copy when the distributed authentication server forwards a request to another distributed authentication server.

Comma-separated list of encryption algorithms that the OpenID Connect clients of the Social Identity Provider service can configure in the Private Key JWT Encryption Algorithm field.

Comma-separated list of HTTP headers to copy to the forwarded response when the server forwards a request to another server.

Comma-separated list of HTTP headers to copy to the forwarded request when the server forwards a request to another server.

Whether universal user IDs are considered case sensitive when matching them.

Whether AM can output logging at the Message level for the org.apache.http.wire and org.apache.http.headers logging appenders.

The class that implements the org.forgerock.openam.http.SslConnectionManager interface, which controls both keystore and truststore settings, as well as hostname verification.

A comma-separated list of audit events that will not be logged.

Whether a session’s authentication level is always the highest authentication level of any authentication module that passed, even if requisite or required modules in the authentication chain weren’t executed. For more information, refer to About Authentication Levels for Chains.

Administration port for the embedded DS server.

When true, AM generates audit log messages for each authentication node reached during authentication tree flows.

When true, AM generates audit log messages with the outcome of authentication tree flows.

Whether AM returns an HTTP 200 or HTTP 401 message when the user fails to complete the required actions to perform session upgrade during transactional authorization. Possible values are:

Days until account expiration set after successful authentication by the account expiration post-authentication plugin.

This property has no effect on authentication trees; it applies to authentication chains only.

Specifies whether input forms and password fields can be autocompleted. This property only affects end-user pages in the classic UI. Possible values are true, to enable autocomplete, and false, to disable it.

Controls whether the results of resource file lookup should be cached.

Specifies whether the server should throw an exception, when it encounters an unknown attribute while parsing file-based configurations. By default, the server ignores any unknown attributes, and doesn’t throw an exception. To override this behavior, set this property to true.

For file-based configurations, enables property value substitution.

Enables access to the CTS REST endpoint /json/tokens.

Determines the digest algorithm used along with PBKDF2 key derivation method for AES Key Wrap encryption. Possible values are SHA1, SHA256, SHA384, or SHA512.

The number of iterations for the key derivation process specified in the org.forgerock.openam.encryption.key.digest advanced property.

The size of the derived key for the AES Key Wrap encryption operations.

Enables the algorithm introduced in AM 7.1 that reduces the performance cost of AES Key Wrap encryption even when high iteration counts are used. Possible values are true, to enable it, and false to disable it.

Specifies the time that new client connections using ForgeRock’s ClientHandler code will wait before timing out.

Specifies the maximum number of connections allowed in the pool available for clients using ForgeRock’s ClientHandler code.

Specifies, in milliseconds, the maximum time-to-live for pooled clients connections using ForgeRock’s ClientHandler code.

Specifies the time that a client using ForgeRock’s ClientHandler code will wait for a response before timing out.

Specifies whether the ForgeRock’s ClientHandler code should retry failed connections. Possible values are true or false.

Specifies whether the ForgeRock’s ClientHandler code should pool and reuse connections. Possible values are true or false.

Lists the target hosts for which requests should not be proxied. Hostnames are separated by commas.

When set to true, AM routes outgoing ForgeRock’s ClientHandler code requests through the HTTP proxy defined on the JVM.

Specifies the password of the proxy that AM will use to route outgoing ForgeRock’s ClientHandler code requests.

Specifies the URI of the proxy that AM will use to route outgoing ForgeRock’s ClientHandler code requests. The URI must be in the format scheme://hostname:port. For example, https://myproxy.example.com:443.

Specifies the username of the proxy that AM will use to route outgoing ForgeRock’s ClientHandler code requests.

Specifies whether the fields in JSON responses are always returned in lowercase. When true, AM converts the fields to lowercase.

Specifies whether AM allows HTTP GET requests, and the use of token as a query parameter in POST requests, on the oauth2/introspect endpoint.

Configures the client-side timeout, in milliseconds, applied to LDAP operations performed with the Netscape LDAP SDK.

Sets the DN cache timeout, in milliseconds, after which an entry should be removed from the cache. A value of 0 means that the DN cache will not expire, and entries will not be removed automatically.

Specifies the number of seconds that AM should wait for a heartbeat operation to the DS server to complete, before considering the connection unavailable.

The protocols AM uses to connect to a secure LDAP server.

Controls whether to publish notifications for consumption by web agents and Java agents.

Lets you override the default maximum refresh token grace period.

Controls whether OpenID Connect clients can register dynamically without providing an access token.

Maximum number of RADIUS client sessions that can be cached concurrently on the AM server.

Specifies the maximum length of redirection URLs validated by AM. The Validation Service and other AM services perform redirection URL validation.

RedirectUrlValidator.isRedirectUrlValid: The url was length 2015 which is longer than the allowed maximum of 2000

Specifies the maximum size of the body of any request made to AM. Learn more in Limit the size of the request body.

Specifies the name of the KeyStoreKeyIdProvider implementation AM uses to provide key ID (kids) to public keys when AM is configured as an OAuth 2.0 authorization server.

Specifies the fully qualified resource ID of the Google Cloud KMS secret used to decrypt secrets as they are read from the filesystem, environment variables, or system properties.

The format used to store the hash of the amAdmin user password.

The period, in seconds, after which the special administrator secret cache expires.

Sets the encryption method for client-side sessions. Possible values are:

The period (in seconds) after which the logout token cache purges expired entries. Changes to this property require a server restart.

Sets the padding mode for RSA encryption of client-side sessions. Possible values are:

Specifies whether signing client-side sessions is enabled. When true, AM allows selecting NONE as the signing algorithm for client-side sessions under Configure > Global Services > Session > Client-Side Sessions.

Specifies the amount of time, in milliseconds, that AM waits before considering that an outbound SMTP connection is unavailable.

Specifies the amount of time, in milliseconds, that AM waits for an SMTP read request to receive an acknowledgement before returning an error.

Specifies the amount of time, in milliseconds, that AM waits for an SMTP write request to receive an acknowledgement before returning an error.

Controls whether trace-level logging messages are generated when message-level debug logging is enabled in AM.

Specifies an ordered list of SSO providers. AM chooses the first applicable provider depending on the context for the requested SSO operation.

Specifies the maximum number of trees in a realm for which to cache the results of "state" scans.

Changes the UI’s behavior when a user session expires. Possible values are false, where the user notices that their session has expired when trying to interact with the UI and they are redirected to the login screen, or true, where AM redirects the user to a page with the session expired message when their session expires. This prevents the display of possible sensitive information on the screen after a session expires.

Maximum size in entries of the OpenIdConnectSSOProvider provider’s cache. This cache is used to map OIDC tokens to SSO tokens for quick lookup.

Maintains a record of subject IDs matched or not matched in a given session. The cache is keyed on the token ID and the session is cleared when destroyed.

By default, calls to the subjectattributes endpoint are enforced per realm.

Specifies the format of the subject (sub) claim of an OAuth 2.0 access token, logout token, and OIDC ID token.

How often to poll the reaper cache for tokens that have expired, and delete them.

The number of records an AM instance will store in its CTS reaper cache.

Specifies a grace period used when searching for expired tokens. Any tokens that expired more than the specified duration ago are returned.

How often to perform a search for expired tokens in the CTS persistence store.

The maximum number of expired tokens to return to the AM reaper when searching the CTS store.

Specifies whether AM support for the DS entry expiration and deletion feature is enabled. Enabling this setting causes AM to clone the value of the coreTokenExpirationDate attribute to the coreTokenTtlDate attribute during token creation, which allows DS to index tokens using the coreTokenTtlDate attribute for the entry expiration and deletion feature.

Specifies whether the AM reaper is enabled.

When the org.forgerock.services.cts.store.ttlsupport.enabled advanced server property is set to true, this property specifies a list of token types which will not have their coreTokenExpirationDate data cloned. For example, SESSION.

Timeout in seconds for LDAP connections to the configuration data store.

Timeout in seconds for LDAP connections used for most CTS operations.

Timeout in seconds for the LDAP connection used for CTS token cleanup.

Port on which SecurID daemon listens.

The maximum time, in seconds, that AM caches client-side session JWTs.

The size, in bytes, of the cache where AM stores client-side session JWTs.

Defines the search base for:

Defines the search filter for:

During authentication, AM records the type of user identified in an identity store. When this setting is enabled, AM uses these stored identities to decide which user to log in.