Deprecated

Fields defined as "properties" in admin.json, config.json, and route configuration files using $location expressions.

Use of ISO-8859-1 encoded text.

Use UTF-8 encoded text instead.

To use UTF-8 encoded text now, set the system property org.forgerock.config.resolvers.properties.encoding to UTF-8.

Not yet removed

The IG_ENVCONFIG_DIRS environment variable and the ig.envconfig.dirs system property.

Any .properties files accessed with the readProperties() function.

The liveness and readiness endpoints

Deprecated endpoints:

Use these endpoints instead:

Not yet removed

Router

Reusing the "directory" setting in multiple Router configurations.

Use different directories for each Router configuration.

Not yet removed

AdminHttpApplication (admin.json)

ping endpoint

health/startup endpoint

Not yet removed

Duration in custom components and scripts

org.forgerock.util.time.Duration

java.time.Duration

Not yet removed

JmsAuditEventHandler

The entire object.

Use an alternative audit event handler.

Not yet removed

Prometheus metrics

Not yet removed

Java support

Java 17

Java 21

Not yet removed

AdminHttpApplication (admin.json)

Provided objects you can override by defining objects with the same name:

"ApiProtectionFilter"
"MetricsProtectionFilter"
"StudioProtectionFilter"

Override defaults by defining filters for the new settings:

"apiProtectionFilter"
"metricsProtectionFilter"
"studioProtectionFilter"

Not yet removed

The "Session" key.

Define a "session" property instead.

Not yet removed

Define a "session" property without using a session manager.

The "session" value is an InMemorySessionManager or JwtSessionManager.

Not yet removed

AuthorizationCodeOAuth2ClientFilter

The "issuerRepository" and "useDeprecatedIssuerRepository" properties.

Each AuthorizationCodeOAuth2ClientFilter will have its own private list of issuers.

Not yet removed

GatewayHttpApplication (config.json)

The "Session" key.

Define a "session" property instead.

Not yet removed

Define a "session" property without using a session manager.

The "session" value is an InMemorySessionManager or JwtSessionManager.

Not yet removed

The session settings will no longer default to those defined in admin.json.

If no "session" is defined, PingGateway will use an InMemorySessionManager with default values.

Not yet removed

Issuer

The "issuerRepository" and "useDeprecatedIssuerRepository" properties.

Each AuthorizationCodeOAuth2ClientFilter will have its own private list of issuers.

Not yet removed

IssuerRepository

The entire object and the default "IssuerRepository" defined in the AdminHttpApplication or GatewayHttpApplication heap.

For issuers known in advance, add their settings to the ClientRegistration.

For discovery, if the IssuerRepository had an "issueHandler", configure an AuthorizationCodeOAuth2ClientFilter "discoveryHandler" instead.

Not yet removed

JwtSession

The entire object.

Use a JwtSessionManager for the "session" in admin.json, config.json, or individual Route configuration.

Not yet removed

Prometheus metrics

The parentId and parentKind metric dimensions are deprecated.

Use the parent_id and parent_kind dimensions instead.

Not yet removed

Router

The default path for the "directory" setting.

Set the "directory" explicitly.

Not yet removed

AdminHttpApplication (admin.json)

Allow administrative connections on gateway endpoints (current default)

Configure a separate "adminConnector" endpoint

Not yet removed

"prefix" setting

-

Not yet removed

"vertx" > "host" setting

"host"

Not yet removed

Lazy loading in FileAttributesFilter and SqlAttributesFilter

target field

FileAttributesContext and SqlAttributesContext

Not yet removed

RouterHandler alias

RouterHandler

Router

Not yet removed

Prometheus endpoint

…​/openig/metrics/prometheus

…​/openig/metrics/prometheus/0.0.4

Not yet removed

Prometheus metrics:

…​_count{…​} …​
…​_seconds_count{…​} …​
…​_total{…​} …​

…​_seconds_count{…​} …​
…​_seconds_sum{…​} …​
…​_sum{…​} …​

Not yet removed

Prometheus metrics:

…​_count{…​} …​
…​_seconds_total{…​} …​

…​_seconds_count{…​} …​
…​_seconds_sum{…​} …​

Not yet removed

TokenResolver class used as follows:

Whole class

Not replaced. Use the following expression format instead: &{…​}

Not yet removed

Vert.x

Options described in 4.5.0 Deprecations and breaking changes

Options described in VertxOptions

Not yet removed

Common REST Monitoring Endpoint

Whole feature

Prometheus Scrape Endpoint

Not yet removed

Java support

Java 11

Java 17

2024.3

Retrieval of the target URI in AuthorizationCodeOAuth2ClientFilter

request.uri
or
originalUri in UriRouterContext

IdpSelectionLoginContext

Not yet removed

Vert.x

maxHeaderSize

initialSettings.maxHeaderListSize

connectors:maxTotalHeadersSize in AdminHttpApplication

Not yet removed

PolicyEnforcementFilter

useLegacyAdviceEncoding

Advice encoding with the encoder used by the AM version.

Not yet removed

CookieFilter

Use of the Set-Cookie2 HTTP header, obsoleted by RFC 6265: Set-Cookie2

Not replaced

Not yet removed

SamlFederationHandler

Whole object

SamlFederationFilter

Not yet removed

Studio

Structured Editor

Not replaced

Not yet removed

KeyStoreSecretStore

Required property storePassword
Optional property keyEntryPassword

Optional property storePasswordSecretId
Optional property entryPasswordSecretId

Not yet removed

HsmSecretStore

property storePassword

property storePasswordSecretId

Not yet removed

Names of Prometheus counter metrics

request
response.error
response.null
response.status.client_error
response.status.informational
response.status.redirection
response.status.server_error
response.status.successful
response.status.unknown

In a future release, the deprecated names are expected to be replaced with names ending in _total.

Only the metric name is deprecated; the information provided by the metric is not deprecated. Other Prometheus metrics aren’t affected.

Not yet removed

Names of Vert.x counter metrics

vertx_net_client_bytes_read
vertx_net_client_bytes_written
vertx_net_client_errors
vertx_http_client_bytes_read
vertx_http_client_bytes_written
vertx_http_client_errors
vertx_net_server_bytes_read
vertx_net_server_bytes_written
vertx_net_server_errors
vertx_http_server_bytes_read
vertx_http_server_bytes_written
vertx_http_server_errors
vertx_datagram_errors
vertx_eventbus_processed
vertx_eventbus_published
vertx_eventbus_discarded
vertx_eventbus_sent
vertx_eventbus_received
vertx_eventbus_delivered
vertx_eventbus_reply_failures
vertx_pool_completed

In a future release, the deprecated names are expected to be replaced with names ending in _total.

Only the metric name is deprecated; the information provided by the metric isn’t deprecated. Other Vert.x metrics aren’t affected.

Not yet removed

KeyStore

Whole object

KeyStoreSecretsStore

There will be no replacement for keystore loading from a URL.

Not yet removed

KeyManager

Whole object

SecretsKeyManager

Not yet removed

TrustManager

Whole object

SecretsTrustManager

Not yet removed

CapturedUserPasswordFilter

A GenericSecret shared key

A CryptoKey shared key.

After removal, it will no longer be possible to store the shared key in a Base64SecretStore.

Not yet removed

CapturedUserPasswordFilter

keyType value DES

AES

2025.3

ClientCredentialsOAuth2ClientFilter

clientId, clientSecretId, handler

endpointHandler, which uses ClientSecretBasicAuthenticationFilter or ClientSecretPostAuthenticationFilter

2025.3

ClientHandler

proxy, systemProxy

proxyOptions

2025.3

hostnameVerifier

ClientTlsOptions property hostnameVerifier

2025.3

ClientRegistration

tokenEndpointAuthMethod
tokenEndpointAuthSigningAlg
privateKeyJwtSecretId
jwtExpirationTimeout

authenticatedRegistrationHandler

2025.3

OAuth2ClientFilter

Filter name

AuthorizationCodeOAuth2ClientFilter

2025.3

ReverseProxyHandler

proxy, systemProxy

proxyOptions

2025.3

hostnameVerifier

ClientTlsOptions property hostnameVerifier
If a ReverseProxyHandler includes the deprecated "hostnameVerifier": "ALLOW_ALL" configuration, it takes precedence, and deprecation warnings are written to the logs.

2025.3