Change default key aliases
For demo and test purposes, AM includes demo key aliases for several features. You can keep the demo key aliases configured for features you aren’t using, or you can remove them from your production environment.
When possible, the following list includes the Global Services or Server Default paths where the demo key aliases are configured. If you have already configured any of the features in a realm, ensure that the key alias is replaced in the realm configuration as well.
To replace the default key aliases:
-
Create the required key aliases following the tasks in Key aliases and passwords.
-
Change the default key aliases:
- Web agents and Java agents
-
Refer to the ForgeRock Web Agents User Guide and the ForgeRock Java Agents Installation Guide for more information.
- Persistent Cookie module
-
To change the default mapping for the Persistent Cookie module, go to Realms > Realm Name > Authentication > Settings > Security. Replace the
testkey alias in the Persistent Cookie Encryption Certificate Alias field with the alias you created for persistent cookies in your secret stores.For more information about the secret labels used by this feature, refer to Secret label mappings for persistent cookies.
- OAuth 2.0 and OpenID Connect providers
-
Review the list of secret labels and their defaults here and here.
- SAML v2.0 hosted providers
-
Review the list of secret labels and their defaults here.
- Client-side sessions
-
Go to Configure > Global Services > Session > Client-Side Sessions. Replace the
testkey alias in the Signing RSA/ECDSA Certificate Alias field and in the Encryption RSA Certificate Alias field. - User self-service
-
Go to Realms > Realm Name > Services > User Self-Service. Populate the values of the Encryption Key Pair Alias and the Signing Secret Key Alias properties.
The name of the demo keys displays in grey. This doesn’t mean the fields are filled in. - Authentication trees
-
Authentication trees use the secret label specified in Secret label mappings for encrypting authentication trees' secure state data.
You must map this secret label to an existing, resolvable secret or key alias. Otherwise, authentication trees might not work as expected.
- IoT
-
The IoT Service uses the secret labels specified in Secret label mappings for the IoT trusted JWT issuer.