Deployment configuration

Default: je

Default: true

Default: securid

Default: false

Default: ~/openam/, such as ~/openam

Default: false

Default: false

Default: true

Default: amlbcookie

To improve AM server performance, keep the value of the cookie set to the AM server ID when using Web Agents.

If you have replaced the value of the this property and you need to match the AM server URLs with their corresponding server IDs, query the global-config/servers endpoint. For example:

In the example above, the server ID for server https://openam.example.com:8443/openam is 01.

Default: 01

Default: DProPCookie

Default: server-host, such as openam.example.com

Default: server-port, such as 8080 or 8443

Refer to Overall Server Cache Settings for important information about this property.

Changes to this property take effect immediately. No server restart is necessary.

Default: true

Default: 1440 (session expires after one day). You can set this property to 0 (session never expires), or any integer higher than 30 (no maximum limit).

Default: false

Default: 180

Default: true

Default: com.sun.identity.shared.ldap.factory.JSSESocketFactory, uses a pure Java provider

Default: 8989

When this property is set to on, AM servers check during startup to determine whether the replication settings for the embedded store are consistent with the number of servers in the site. If they are not consistent, AM reconfigures replication to match the existing number of servers in the site.

Default: false

Default: true

Default: AMAuthCookie

Example: com.sun.identity.authentication.client.ipAddressHeader=X-Forwarded-For

Default: false

Default: true

Default: cn=dsameuser,ou=DSAME Users,dc=openam,dc=forgerock,dc=org

You must manually create a user account for the new administrative user in the configuration data store that has the same privileges as the uid=admin user.

Default: uid=amAdmin,ou=People,dc=openam,dc=forgerock,dc=org

Default: sunIdentityServerAuthNServer

Default: server-protocol://server-host:server-port/server-uri/notificationservice, such as https://openam.example.com:8443/openam/notificationservice

Default: 3

Note that this configuration option is used only in non-UI deployments. The UI cannot set the HttpOnly name in a cookie.

Default: false

Available settings are as follows:

Default: false

Default: true

Default: off

Default: service:jmx:rmi://

Default: server-uri, such as openam

Default: 10:10:10, meaning evaluation of rules, then conditions, then subjects

Default: 10000

Default: false

To map myserver to myserver.example.com, set com.sun.identity.server.fqdnMap[myserver]=myserver.example.com.

Default: false

Default: false

Multi-instance deployments require consistent use of this property, which should be configured under Configure > Server Defaults > Advanced.

The am.encryption.pwd property must also be the same for all deployed instances. You can set the Password Encryption Key property under Deployment > Servers > Server Name > Security. Verify that all servers have the same setting for this property.

Default: false

See Overall Server Cache Settings for important information about this property.

Changes to this property take effect immediately. No server restart is necessary.

Default: true

Changes to this property take effect immediately. No server restart is necessary.

Default: 30

Changes to this property take effect immediately. No server restart is necessary.

Default: false

Default: /path/to/openam/

Default: com.sun.identity.sm.ldap.SMSEmbeddedLdapObject

Default: 30000

If set to false, then AM only checks the Socket connection, and does not perform an HTTP GET.

If each AM server runs behind a reverse proxy, then the default setting of true means the health check actually runs against the AM instance, rather than checking only the Socket to the reverse proxy.

Default: true

Default: URL to the /openam/namingservice endpoint on the remote server

Default: false

Default: WEB_CONTAINER

Default: true

Default: AMDistAuthCookie

Default: org.forgerock.openam.authentication.service.DefaultSessionPropertyUpgrader

Default: false

Default: false

Default: UTF-8

Default: connection

Default: connection

For a list of algorithms that AM supports, refer to the JSON Web Algorithms (JWA) internet draft.

For more information, refer to the Social Identity Provider service client configuration reference.

Unrecognized or unsupported algorithms will be saved, but not exposed in the Private Key JWT Encryption Algorithm field.

This property is hot-swappable.

Default: RSA-OAEP,RSA-OAEP-256,ECDH-ES

Requests are forwarded when the server receiving the request is not the server that originally initiated authentication. The server that originally initiated authentication is identified by a cookie.

When the distributed authentication service (DAS) is in use, then the cookie is the AMDistAuthCookie that identifies the DAS server by its URL.

When authentication is done directly on AM, then the cookie is the AMAuthCookie that holds a session ID that identifies the AM server.

On subsequent requests the server receiving the request checks the cookie. If the cookie identifies another server, the current server forwards the request to that server.

If a header such as Cache-Control has been included in the list of values for the property openam.retained.http.request.headers and the header must also be copied to the response, then add it to the list of values for this property.

Example: openam.retained.http.headers=X-DSAMEVersion,Cache-Control

Default: X-DSAMEVersion

Requests are forwarded when the server receiving the request is not the server that originally initiated authentication. The server that originally initiated authentication is identified by a cookie.

When the distributed authentication service (DAS) is in use, then the cookie is the AMDistAuthCookie that identifies the DAS server by its URL.

When authentication is done directly on AM, then the cookie is the AMAuthCookie that holds a session ID that identifies the AM server.

On subsequent requests the server receiving the request checks the cookie. If the cookie identifies another server, the current server forwards the request to that server.

When configuring the distributed authentication service, or when a reverse proxy is set up to provide the client IP address in the X-Forwarded-For header, if your deployment includes multiple AM servers, then this property must be set to include the header.

Example: openam.retained.http.request.headers=X-DSAMEVersion,X-Forwarded-For

AM copies the header when forwarding a request to the authoritative server where the client originally began the authentication process, so that the authoritative AM server receiving the forwarded request can determine the real client IP address.

In order to retain headers to return in the response to the AM server that forwarded the request, use the property openam.retained.http.headers.

Default: X-DSAMEVersion

Default: false

Possible values are:

You can also set this property as a JVM option in the container where AM runs.
Default: false

If the container in which AM runs is configured with the java.protocol.handler.pkgs property set, then ensure this property is set to com.sun.identity.protocol.AmSslConnectionManager.

The following events can be suppressed:

Default: false

Default: 4444

Possible values are true or false.

Default: true

Possible values are true or false.

Default: true

Default: false

Default: 30

Enables or disables the ForceAuth authentication parameter. If this property is set to false, the ForceAuth parameter will always be false, regardless of what the administrator sets. If this property is true, the configured value of the ForceAuth parameter is respected.

In new installations, this property is set to false by default, which means that the value of ForceAuth is always false.

When you upgrade AM, this property is set to true by default, which means that the value of ForceAuth is respected.

Default: false for new installations, true for upgraded installations

Default: true

While you are customizing the UI as described in UI customization, set this property to false to allow AM immediately to pick up changes to the files as you customize them.

Reset this to the default, true, when using AM in production.

Default: true

Default: false

Takes the following values:

Default: OFF

Even when access to the CTS REST endpoint is enabled, only the AM global administrator has authorization to perform operations against /json/tokens.

Default: false

After changing this property, you must restart AM or the container in which it runs for the change to take effect.

Set this property in AM’s web container’s startup script. For more information, refer to Use stronger encryption algorithms.

Default: SHA1

Set this property in AM’s web container’s startup script. For more information, refer to Use stronger encryption algorithms.

Default:`10000`

Set this property in AM’s web container’s startup script. For more information, refer to Use stronger encryption algorithms.

Default: 128

If you configure a large iteration count when this property is set to false, AM startup times may refer to a performance impact if there are many agents in your deployment.

Set this property in AM’s web container’s startup script. For more information, refer to Use stronger encryption algorithms.

Default: false

The value is a string specifying a number and a unit of time.

Restart AM or the container in which it runs for the change to take effect.

Default: 10 seconds

Use this property only when the org.forgerock.openam.httpclienthandler.system.clients.reuse.connections.enabled advanced server property is enabled.

Restart AM or the container in which it runs for the change to take effect.

Default: 64

Restart AM or the container in which it runs for the change to take effect.

Default: Not set

The value is a string specifying a number and a unit of time.

Restart AM or the container in which it runs for the change to take effect.

Default: 10 seconds

Restart AM or the container in which it runs for the change to take effect.

Default: true

Restart AM or the container in which it runs for the change to take effect.

Default: true

This property supports wildcards at the start and end of any value. For example, *.example.com would result in a match for customers.example.com and staff.example.com, and requests would not be proxied for those target hosts.

Configure alongside the org.forgerock.openam.httpclienthandler.system.proxy.uri, org.forgerock.openam.httpclienthandler.system.proxy.username, and org.forgerock.openam.httpclienthandler.system.proxy.password advanced server properties.

Default: localhost,127.*,[::1],0.0.0.0,[::0]

Restart AM or the container in which it runs for the change to take effect.

Default: Not set

Configure alongside the org.forgerock.openam.httpclienthandler.system.proxy.username, org.forgerock.openam.httpclienthandler.system.proxy.uri, and org.forgerock.openam.httpclienthandler.system.nonProxyHosts advanced server properties.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set

If the proxy requires authentication, also configure the org.forgerock.openam.httpclienthandler.system.proxy.username and org.forgerock.openam.httpclienthandler.system.proxy.password properties, and, optionally, the org.forgerock.openam.httpclienthandler.system.nonProxyHosts property.

This property takes precedence over the org.forgerock.openam.httpclienthandler.system.proxy.enabled advanced server property and its related JVM properties.

For more information, refer to Configuring AM for Outbound Communication.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set

Configure alongside the org.forgerock.openam.httpclienthandler.system.proxy.password and org.forgerock.openam.httpclienthandler.system.proxy.uri advanced server properties.

Restart AM or the container in which it runs for the change to take effect.

Default: Not set

Default: false

For security reasons, and in accordance with the OAuth 2.0 Token Introspection specification, AM disallows HTTP GET requests on the introspection endpoint, and requires HTTP POST requests instead. AM also disallows the use of token as a query parameter in a POST request on that endpoint; for example, /oauth2/introspect?token=access-token.

If your clients in an existing deployment need to send a GET request or token as a query parameter to the oauth2/introspect endpoint, you can change this setting to true. However, it is recommended that you adjust your clients to use the more secure setting.

Default: false

Default: 0 (no time limit)

Default: 0 (no time limit)

Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. You can turn this off by setting the value to 0.

Default: 10

This property does not apply to web or Java agent versions earlier than version 5. If the deployment uses only earlier versions of web and Java agents, you can set this property to false.

Default: true

By default, you cannot set a grace period that exceeds 120 seconds. Setting this server property to true disables the maximum and lets you set any grace period up to the maximum positive integer value. This value affects the refresh token grace period set in the OAuth2.0 provider configuration or on any OAuth 2.0 clients.

Default: false

If you set this to true in production, take care to limit or throttle dynamic client registrations.

Default: false

Default: 5000

The default value should be adequate in most cases. Increase the default value as needed if messages similar to the following appear in your debug log files with message-level debugging enabled:

Default: 2000

The property is hot-swappable. You do not need to restart AM for the changes to take effect.

Default: 1 MB (1048576 bytes)

For more information, refer to Customizing Public Key IDs.

Default: org.forgerock.openam.secrets.DefaultKeyStoreKeyIdProvider.

This property may also specify the Google Cloud KMS secret used to decrypt the hash of the password of the amAdmin user, if the value of the org.forgerock.openam.secrets.special.user.passwords.format advanced server property is set to GOOGLE_KMS_ENCRYPTED.

Only one key can be specified at a time.

For more information, refer to Using Google Cloud KMS Secrets to Decrypt AM Secrets and Changing the amAdmin Password (Secret Stores).

This property has no default.

Possible values are:

For more information, refer to Changing the amAdmin Password (Secret Stores).
Default: ENCRYPTED_PLAIN

Default: A128CBC-HS256

Default: 60

For more information, refer to Invalidate all sessions for a user.

Default: RSA-OAEP-256

Default: 10000

Default: 10000

Default: 10000

Certain components that run in AM’s JVM, such as embedded DS configuration stores, write a large volume of trace-level debug records that are not required for troubleshooting in many cases. With this option set to false, trace-level debug records are not written for these components.

If you set this to true in production, take care to monitor the amount of disk space occupied by the AM debug logs.

Default: false

Default: org.forgerock.openidconnect.ssoprovider.OpenIdConnectSSOProvider, org.forgerock.openam.sso.providers.stateless.StatelessSSOProvider

AM recursively scans the nodes and paths in authentication trees to determine the state data that each node consumes. Caching this information for a number of trees in each realm means AM does not have to make multiple calls to get the tree’s structure.

If you have many complex authentication trees and a large number of realms, increasing this value may reduce the impact on performance of the consumed state scans.

Default: 15

This setting does not apply to those users that are global or realm administrators, for example, amAdmin.

Default: true

Default: 5000

Default: 10000

Tokens using the old sub format will still be accepted after the property is enabled. Before enabling this property, ensure that your clients can use the new sub claim format, or a combination of the sub and the subname claims.

Default: true for new installations, false for upgrades

Possible values are:

For example, (usr!demo), or (age!myOAuth2Client).

By default, an AM instance will review its cache for tokens eligible for deletion every 100 milliseconds.

Default: 100 (milliseconds)

For more information, refer to Tune the CTS.]

Default: 500000

For more information, refer to Tune the CTS.

Default: 300000 (milliseconds)

For more information, refer to Tune the CTS.

Default: 5000 (milliseconds)

For more information, refer to Tune the CTS.

Default: 5000

For more information, refer to Tune the CTS.

This property does not clone the values of tokens that were created before the setting was enabled.

Set this property to true in conjunction with the org.forgerock.services.cts.store.ttlsupport.exclusionlist advanced server property when you need to configure the AM reaper to manage the expiration time for a subset of the tokens in the CTS store only.

For more information, refer to Manage expired CTS tokens.

Default: false

Set this property to true in the following scenarios:

The AM reaper will delete the excluded tokens when they expire.

For more information, refer to Manage expired CTS tokens.
Default: Not set

Default: 10 (seconds)

For suggested settings, see Tuning CTS Store LDAP Connections.

Default: 10 (seconds)

For suggested settings, see Tuning CTS Store LDAP Connections.

Default: None (do not time out)

For suggested settings, see Tuning CTS Store LDAP Connections.

Default: 58943

Setting a long cache timeout may be more efficient, but AM will not detect if a client-side session JWT has expired or has become invalid until the cache expires.

The property is hot-swappable. You do not need to restart AM for the changes to take effect.

Default: 10

Default: 10000

This lets the authentication trees engine correctly resolve identities that have the same username.

For more information, refer to the custom node documentation and the scripted decision node API.

Default: true