Core authentication attributes
Every AM realm has a set of authentication properties that applies to all authentication performed to that realm. The settings are referred to as core authentication attributes.
To edit the authentication configuration in a realm, navigate to Realms > Realm Name > Authentication > Settings in the AM admin UI.
Core
The following properties are available under the Core tab:
- Administrator Authentication Configuration
-
Specifies the default authentication journey used when an administrative user, such as
amAdmin
, logs in to the AM admin UI. - Organization Authentication Configuration
-
Specifies the default authentication journey used when a non-administrative user logs in to AM.
amster
attribute:orgConfig
User Profile
The following properties are available under the User Profile tab:
User Profile
-
Specifies whether a user profile needs to exist in the user data store, or should be created on successful authentication. The possible values are:
true
. Dynamic.-
After successful authentication, AM creates a user profile if one does not already exist. AM then issues the SSO token. AM creates the user profile in the user data store configured for the realm.
createAlias
. Dynamic with User Alias.-
After successful authentication, AM creates a user profile that contains the
User Alias List
attribute, which defines one or more aliases for mapping a user’s multiple profiles. ignore
. Ignored.-
After successful authentication, AM issues an SSO token regardless of whether a user profile exists in the data store. The presence of a user profile is not checked.
Any functionality which needs to map values to profile attributes, such as SAML or OAuth 2.0, will not operate correctly if the User Profile property is set to
ignore
. false
. Required.-
After successful authentication, the user must have a user profile in the user data store configured for the realm in order for AM to issue an SSO token.
- Alias Search Attribute Name
-
After a user is successfully authenticated, the user’s profile is retrieved. AM first searches for the user based on the data store settings. If that fails to find the user, AM will use the attributes listed here to look up the user profile. This setting accepts any data store specific attribute name.
amster
attribute:aliasAttributeName
Account Lockout
The following properties are available under the Account Lockout tab:
- Login Failure Lockout Mode
-
When enabled, AM deactivates the LDAP attribute defined in the Lockout Attribute Name property in the user’s profile upon login failure. This attribute works in conjunction with the other account lockout and notification attributes.
amster
attribute:loginFailureLockoutMode
- Login Failure Lockout Count
-
Defines the number of attempts that a user has to authenticate within the time interval defined in Login Failure Lockout Interval before being locked out.
amster
attribute:loginFailureCount
- Login Failure Lockout Interval
-
Defines the time in minutes during which failed login attempts are counted. If one failed login attempt is followed by a second failed attempt within this defined lockout interval time, the lockout count starts, and the user is locked out if the number of attempts reaches the number defined by the Login Failure Lockout Count property. If an attempt within the defined lockout interval time proves successful before the number of attempts reaches the number defined by the Login Failure Lockout Count property, the lockout count is reset.
amster
attribute:loginFailureDuration
- Email Address to Send Lockout Notification
-
Specifies one or more email addresses to which notification is sent if a user lockout occurs.
Separate multiple addresses with spaces, and append
|locale|charset
to addresses for recipients in non-English locales.amster
attribute:lockoutEmailAddress
- Warn User After N Failures
-
Specifies the number of authentication failures after which AM displays a warning message that the user will be locked out.
- Login Failure Lockout Duration
-
Defines how many minutes a user must wait after a lockout before attempting to authenticate again. Entering a value greater than 0 enables memory lockout and disables physical lockout. Memory lockout means the user’s account is locked in memory for the number of minutes specified. The account is unlocked after the time period has passed.
amster
attribute:lockoutDuration
- Lockout Duration Multiplier
-
Defines a value with which to multiply the value of the Login Failure Lockout Duration attribute for each successive lockout. For example, if Login Failure Lockout Duration is set to 3 minutes, and the Lockout Duration Multiplier is set to 2, the user is locked out of the account for 6 minutes. After the 6 minutes has elapsed, if the user again provides the wrong credentials, the lockout duration is then 12 minutes. With the Lockout Duration Multiplier, the lockout duration is incrementally increased based on the number of times the user has been locked out.
amster
attribute:lockoutDurationMultiplier
- Lockout Attribute Name
-
Defines the LDAP attribute used for physical lockout. The default attribute is
inetuserstatus
, although the field in the AM admin UI is empty. The Lockout Attribute Value field must also contain an appropriate value.amster
attribute:lockoutAttributeName
- Lockout Attribute Value
-
Specifies the action to take on the attribute defined in Lockout Attribute Name. The default value is
inactive
, although the field in the AM admin UI is empty. The Lockout Attribute Name field must also contain an appropriate value.amster
attribute:lockoutAttributeValue
- Invalid Attempts Data Attribute Name
-
Specifies the LDAP attribute used to hold the number of failed authentication attempts towards Login Failure Lockout Count. Although the field appears empty in the AM admin UI, AM stores this data in the
sunAMAuthInvalidAttemptsDataAttrName
attribute defined in thesunAMAuthAccountLockout
objectclass by default.amster
attribute:invalidAttemptsDataAttributeName
- Store Invalid Attempts in Data Store
-
When enabled, AM stores the information regarding failed authentication attempts as the value of the Invalid Attempts Data Attribute Name in the user data store. Information stored includes number of invalid attempts, time of last failed attempt, lockout time and lockout duration. Storing this information in the identity repository allows it to be shared among multiple instances of AM.
Enable this property to track invalid log in attempts when using CTS-based or client-based authentication sessions.
amster
attribute:storeInvalidAttemptsInDataStore
General
The following properties are available under the General tab:
- Default Authentication Locale
-
Specifies the default language subtype to be used by the Authentication Service. The default value is
en_US
.amster
attribute:locale
- Identity Types
-
Lists the type or types of identities used during a profile lookup. You can choose more than one type; this lets AM conduct a second lookup if the first lookup fails.
The
Identity Types
property does not apply to Identity Cloud.amster
attribute:identityType
The possible values are:
Agent
-
Searches for identities under your agents.
agentgroup
-
Searches for identities according to your established agent group.
agentonly
-
Searches for identities only under your agents.
Group
-
Searches for identities according to your established groups.
User
-
Searches for identities according to your users.
Default:
Agent
andUser
. - Use Client-Based Sessions
-
When enabled, AM assigns client-based sessions to users authenticating to this realm. Otherwise, AM users authenticating to this realm are assigned CTS-based sessions.
amster
attribute:statelessSessionsEnabled
- External Login Page URL
-
Specifies the URL of the external login user interface, if the authentication user interface is hosted separately from AM.
When set, AM will use the provided URL as the base of the resume URI, rather than using the Base URL Source Service to obtain the base URL. AM will use this URL when constructing the resume URI if authentication is suspended in an authentication tree.
amster
attribute:externalLoginPageUrl
- Default Authentication Level
-
Specifies the default authentication level for authentication nodes.
The
Default Authentication Level
property does not apply to Identity Cloud.amster
attribute:defaultAuthLevel
Trees
The following properties are available under the Trees tab:
- Authentication session state management scheme
-
Specifies the location where AM stores authentication sessions.
Possible values are:
-
CTS
. AM stores authentication sessions in the CTS token store. -
JWT
. AM sends the authentication session to the client as a JWT. -
In-Memory
. AM stores authentication sessions in its memory.
For more information on authentication session storage locations, and the requirements for each, see Sessions and cookies.
Default:
JWT
(new installations),In-Memory
(after upgrade)amster
attribute:authenticationSessionsStateManagement
-
- Max duration (minutes)
-
Specifies the maximum allowed duration of an authentication session, including any time spent in the suspended state, in minutes.
Values from
1
to2147483647
are allowed.Default:
5
amster
attribute:authenticationSessionsMaxDuration
- Suspended authentication duration (minutes)
-
Specifies the length of time an authentication session can be suspended, in minutes.
Suspending an authentication session allows time for out-of-band authentication methods, such as responding to emailed codes or performing an action on an additional device. The value must be less than or equal to the total time allowed for an authentication session, specified in the Max duration (minutes) property.
Values from
1
to2147483647
are allowed.Default:
5
- Enable whitelisting
-
When enabled, AM allowlists authentication sessions to protect them against replay attacks.
Default: Disabled
amster
attribute:authenticationSessionsWhitelist
Security
The following properties are available under the Security tab:
- Module Based Authentication
-
When enabled, users can authenticate using module-based authentication. Otherwise, all attempts at authentication using the
module=module-name
login parameter result in failure.ForgeRock recommends disabling module-based authentication in production environments.
The
Module Based Authentication
property does not apply to Identity Cloud.amster
attribute:moduleBasedAuthEnabled
ssoadm
attribute:sunEnableModuleBasedAuth
- Persistent Cookie Encryption Certificate Alias
-
Specifies the key pair alias in the AM keystore to use for encrypting persistent cookies.
Default:
test
amster
attribute:keyAlias
ssoadm
attribute:iplanet-am-auth-key-alias
- Zero Page Login
-
When enabled, AM allows users to authenticate using only GET request parameters without showing a login screen.
Enable with caution as browsers can cache credentials and servers can log credentials when they are part of the URL.
AM always allows HTTP POST requests for zero page login.
Default: false (disabled)
The
Zero Page Login
property does not apply to Identity Cloud.amster
attribute:zeroPageLoginEnabled
ssoadm
attribute:openam.auth.zero.page.login.enabled
- Zero Page Login Referer Whitelist
-
Lists the HTTP referer URLs for which AM allows zero page login. These URLs are supplied in the
Referer
HTTP request header, allowing clients to specify the web page that provided the link to the requested resource.When zero page login is enabled, including the URLs for the pages from which to allow zero page login will provide some mitigation against Login Cross-Site Request Forgery (CSRF) attacks. Leave this list blank to allow zero page login from any Referer.
This setting applies for both HTTP GET and also HTTP POST requests for zero page login.
The
Zero Page Login Referer Whitelist
property does not apply to Identity Cloud.amster
attribute:zeroPageLoginReferrerWhiteList
- Zero Page Login Allowed Without Referer?
-
When enabled, allows zero page login for requests without an HTTP
Referer
request header. Zero page login must also be enabled.Enabling this setting reduces the risk of login CSRF attacks with zero page login enabled, but may potentially deny legitimate requests.
amster
attribute:zeroPageLoginAllowedWithoutReferrer
- Organization Authentication Signing Secret
-
Specifies a cryptographically-secure random-generated HMAC shared secret for signing RESTful authentication requests. When users attempt to authenticate to the UI, AM signs a JSON Web Token (JWT) containing this shared secret. The JWT contains the authentication session ID, realm, and authentication index type value, but does not contain the user’s credentials.
When modifying this value, ensure the new shared secret is Base-64 encoded and at least 128 bits in length.
amster
attribute:sharedSecret
Post Authentication Processing
The following properties are available under the Post Authentication Processing tab:
- Default Success Login URL
-
Accepts a list of values that specifies where users are directed after successful authentication. The format of this attribute is
client-type|URL
although the only value you can specify at this time is a URL which assumes the type HTML. The default value is/openam/console
. Values that do not specify HTTP have that appended to the deployment URI.amster
attribute:loginSuccessUrl
- Default Failure Login URL
-
Accepts a list of values that specifies where users are directed after authentication has failed. The format of this attribute is
client-type|URL
although the only value you can specify at this time is a URL which assumes the type HTML. Values that do not specify HTTP have that appended to the deployment URI.amster
attribute:loginFailureUrl
- Authentication Post Processing Classes
-
Specifies one or more Java classes used to customize post authentication processes for successful or unsuccessful logins. The Java class must implement the
com.sun.identity.authentication.spi.AMPostAuthProcessInterface
AM interface.A
.jar
file containing the post processing class belongs in theWEB-INF/lib
directory of the deployed AM instance. If you do not build a.jar
file, add the class files underWEB-INF/classes
. For deployment, add the.jar
file or classes into a custom AM.war
file.The
Authentication Post Processing Classes
property does not apply to Identity Cloud.For information about post-authentication processing for trees, see Create Post-Authentication Hooks for Trees.
amster
attribute:loginPostProcessClass
- Generate UserID Mode
-
When enabled, the Membership module generates a list of alternate user identifiers if the one entered by a user during the self-registration process is not valid or already exists. The user IDs are generated by the class specified in the Pluggable User Name Generator Class property.
The
Generate UserID Mode
property does not apply to Identity Cloud.amster
attribute:usernameGeneratorEnabled
- Pluggable User Name Generator Class
-
Specifies the name of the class used to generate alternate user identifiers when Generate UserID Mode is enabled. The default value is
com.sun.identity.authentication.spi.DefaultUserIDGenerator
.amster
attribute:usernameGeneratorClass
- User Attribute Mapping to Session Attribute
-
Enables the authenticating user’s identity attributes (stored in the identity repository) to be set as session properties in the user’s SSO token. The value takes the format
User-Profile-Attribute|Session-Attribute-Name
. If Session-Attribute-Name is not specified, the value of User-Profile-Attribute is used. All session attributes contain theam.protected
prefix to ensure that they cannot be edited by the client applications.For example, if you define the user profile attribute as
mail
and the user’s email address, available in the user session, asuser.mail
, the entry for this attribute would bemail|user.mail
. After a successful authentication, theSSOToken.getProperty(String)
method is used to retrieve the user profile attribute set in the session. The user’s email address is retrieved from the user’s session using theSSOToken.getProperty("am.protected.user.mail")
method call.Properties that are set in the user session using User Attribute Mapping to Session Attributes cannot be modified (for example,
SSOToken.setProperty(String, String)
). This results in anSSOException
. Multivalued attributes, such asmemberOf
, are listed as a single session variable with a|
separator.The
User Attribute Mapping to Session Attribute
property does not apply to Identity Cloud.For authentication trees, use the Scripted Decision node to retrieve user attributes and session properties, or the Set Session Properties node for session properties only.
amster
attribute:userAttributeSessionMapping