• OPENAM-7235: Fetch additional SSOToken attributes like legacy REST interface

• OPENAM-7123: Allow country-specific localization in XUI

• OPENAM-7109: Allow user to adjust the size of Metadata that can be uploaded by the Common Task "Create SAMLv2 Providers" buttons.

• OPENAM-7055: Improved logic for POST binding Assertion/Response signature check

• OPENAM-6892: Create a Shared Secret Provider plugin for the standard OATH module

• OPENAM-6872: Improved error message in OpenSSOConfigurator

• OPENAM-6534: Update OAuth2 tokeninfo endpoint to be realm-independent

• OPENAM-6272: Allow storing the shared secret in an encrypted format for the OATH Module

• OPENAM-6266: Allow the confirmation email URL in the Forgotten password service to be a relative path

• OPENAM-6236: Add token life time options per OAuth2 client

• OPENAM-6069: Make org.forgerock.openam.agents.config.policy.evaluation.* optional

• OPENAM-5859: Support the form_post OAuth 2.0 response mode

• OPENAM-5785: Allow ssoadm to import and export agent configurations with hashed passwords

• OPENAM-5759: Update OAuth2 to display the token and user information in the OAuth2Provider.access log

• OPENAM-5755: Prevent duplicate metaAliases in SAML2 entities

• OPENAM-5695: Allow admin users to update user's password without the old password

• OPENAM-5477: Add configuration to allow OAuth2 Refresh Tokens to never expire

• OPENAM-5419: Update TokenExpired exception message to be consistent

• OPENAM-5332: Update OAuth2 RefreshTokenServerResource to check the clientID case insensitively

• OPENAM-5311: Update Default timelimit in Netscape SDK to be configurable

• OPENAM-5260: Provide option to only sign Response when using HTTP-POST binding

• OPENAM-5097: Update LDAP and AD auth modules to support startTLS extended operation

• OPENAM-5065: PLLClient should call getErrorStream() to get response body on IOException.

• OPENAM-4923: Update Windows Desktop SSO module to allow whitelisting Kerberos realms/KDCs

• OPENAM-4459: OpenID Connect attribute mappings should be localizable

• OPENAM-4177: Update OAuth2 access_token endpoint to handle auth chain with non-name/password callback

• OPENAM-4103: Allow sending AuthnRequests without the RequestedAuthnContext element

• OPENAM-3743: Update OAuth2 authorization consent pages to be fully localizable

• OPENAM-3714: Update DJLDAPv3Repo to support StartTLS

• OPENAM-3493: Update SAML to support multiple keys (key rollover)

• OPENAM-2238: Support extensibility of auth context classes as described in the SAMLv2 spec

• OPENAM-1900: Provide support for more XML signatures types in SAML query string verification process

• OPENAM-1650: Implement REST services for manipulating Session properties

• OPENAM-1631: Add option to enable debug logging of decrypted SAML assertions

These changes are new in OpenAM 13:

• It is strongly recommended not to use the forward slash character in policy names. Users running OpenAM servers on Tomcat and JBoss web containers will not be able to manipulate policies with the forward slash character in their names without setting the ‑Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true argument in the CATALINA_OPTS environment variable before starting the OpenAM web container.

  It is also strongly recommended not to enable the ALLOW_ENCODED_SLASH=true setting while running OpenAM in production. Using this option introduces a security risk. See Apache Tomcat 6.x Vulnerabilities and the related CVE for more information.

  If you have policy names with forward slashes after migration to OpenAM 13, rename the policies so that they do not have forward slashes. Perform the following steps if you use Tomcat or JBoss as your OpenAM web container:

  1. Stop the OpenAM web container.

  2. Add the ‑Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true setting to the CATALINA_OPTS environment variable.

  3. Restart the OpenAM web container.

  4. Rename any policies with forward slashes in their names.

  5. Stop the OpenAM web container.

  6. Remove the ‑Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true setting from the CATALINA_OPTS environment variable.

  7. Restart the OpenAM web container.

• New Attribute Required in Authentication Service Definition. OpenAM 13 requires that schemas in the definition of an authentication service contain resourceName attributes.

  The attributes are not added to custom authentication service definitions when upgrading from a previous version, so must be added manually.

  The specific changes required in the service definition schema are:

  • The Schema element in the service definition must contain a resourceName attribute. This value is used to refer to the service when managing the service using REST.

    For example:

    <Schema
     serviceHierarchy="/DSAMEConfig/authentication/iPlanetAMAuthSampleAuthService"
     i18nFileName="amAuthSampleAuth"
     revisionNumber="10"
     i18nKey="sampleauth-service-description"
     resourceName="mySampleAuthService">

  • Any SubSchema elements in the service definition must contain a resourceName attribute, with a value of USE-PARENT.

    For example:

    <SubSchema
     name="serverconfig"
     inheritance="multiple"
     resourceName="USE-PARENT">

  An example of a service definition compatible with OpenAM 13 can be found in Section 4.3.6, "The Sample Auth Service Configuration" in the Developer's Guide.

  Procedure 4.1. To Add Required Attributes to Custom Service Definition Schemas

  You can add the required attributes either before or after upgrading to OpenAM 13. The steps in this procedure cover adding the attributes before upgrading.

  1. If you have not already done so, install and configure a tool for altering the contents of the OpenDJ configuration store, for example the OpenDJ Control Panel or Apache Directory Studio.

  2. Connect to the embedded configuration store using the same bind DN credentials as configured in OpenAM. The default is cn=Directory Manager.

  3. In the directory tree of the configuration store, locate the sunServiceSchema attribute for your custom service definition under ou=services.

     For example, on a default install the definition for the data store service is located here: ou=1.0,ou=sunAMAuthDataStoreService,ou=services,dc=openam,dc=forgerock,dc=org

  4. Edit the XML stored within the sunServiceSchema attribute, adding the required resourceName attribute to Schema and SubSchema elements.

  5. Commit the changes to the configuration store, and proceed to upgrade OpenAM.

  Failure to add the required attributes will result in the OpenAM 13 user interface being unable to view or edit custom services, or create or edit authentication modules based on them after upgrade. You may also see a Not found error message displayed in the administration console when creating or editing authentication modules.

• Changes to SAML 2.0 NameID Persistence. OpenAM's SAML 2.0 account management and NameID persistence logic has been updated to work better with non-persistent NameID formats.

  The NameID persistence logic is summarized as follows:

  
  Persistent NameID         -> NameID MUST be stored
  Transient NameID          -> NameID MUST NOT be stored
  Ignored user profile mode -> NameID CANNOT be stored (fails if used in
                               combination with persistent NameID-Format)
  For any other case        -> NameID MAY be stored based on customizable logic
      

  The following changes have been made on the identity provider side:

  • New Setting: idpDisableNameIDPersistence. OpenAM now provides a new setting, idpDisableNameIDPersistence, which disables the storage of the NameID values for all NameIDs issued by that IdP instance, as long as the NameID-Format is anything but urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.

  • SP's spDoNotWriteFederationInfo Repurposed. The SP's spDoNotWriteFederationInfo setting has been repurposed. It no longer is specific to unspecified NameID-Formats. Now, it affects all non-persistent NameID-Formats, similar to the idpDisableNameIDPersistence setting in the IdP configuration.

  • NameID Lookup Changes. The NameID lookup mechanism has been modified, so that it only tries to look up existing NameID values for the user if the NameID is actually persisted for the corresponding NameID-Format.

  • New Method in the IDPAccountMapper Interface. The IDPAccountMapper interface has been extended with the following new method:

    /**
    * Tells whether the provided NameID-Format should be persisted in the user data
    *       store or not.
    *
    * @param realm The hosted IdP's realm.
    * @param hostEntityID The hosted IdP's entityID.
    * @param remoteEntityID The remote SP's entityID.
    * @param nameIDFormat The non-transient, non-persistent NameID-Format in question.
    * @return true if the provided NameID-Format should be persisted
    *       in the user data store, false otherwise.
    */
    public boolean shouldPersistNameIDFormat(String realm, String hostEntityID,
           String remoteEntityID,String nameIDFormat);
          

    The default implementation of shouldPersistNameIDFormat in DefaultIDPAccountMapper first checks whether idpDisableNameIDPersistence is enabled in the hosted IdP configuration. If idpDisableNameIDPersistence is disabled, the logic advances and accesses the remote SP's spDoNotWriteFederationInfo flag.

  The following changes have been made on the service provider side:

  • Changes to SPAccountMapper. The SPAccountMapper implementations now no longer need to perform reverse lookups using the received NameID value. The SPACSUtils now performs the reverse lookup if the NameID-Format should be persisted. This change was made to ensure that NameID values are only persisted in the data store if they have not been stored there previously.

  • SP's spDoNotWriteFederationInfo Repurposed. The SP's spDoNotWriteFederationInfo setting has been repurposed. It no longer is specific to unspecified NameID-Formats. It affects all non-persistent NameID-Formats.

  • New Method in the SPAccountMapper Interface. The SPAccountMapper interface has been extended with the following new method:

    /**
    * Tells whether the provided NameID-Format should be persisted in the user data
    *       store or not.
    *
    * @param realm The hosted SP's realm.
    * @param hostEntityID The hosted SP's entityID.
    * @param remoteEntityID The remote IdP's entityID.
    * @param nameIDFormat The non-transient, non-persistent NameID-Format in question.
    * @return true if the provided NameID-Format should be persisted
    *       in the user data store, false otherwise.
    */
    public boolean shouldPersistNameIDFormat(String realm, String hostEntityID,
           String remoteEntityID, String nameIDFormat);
          

    The default implementation of shouldPersistNameIDFormat in DefaultLibrarySPAccountMapper checks whether spDoNotWriteFederationInfo is enabled in the hosted SP configuration.

  For more information, see OPENAM-3470.

• AD/LDAP/RADIUS Authentication Modules Allow More Than One Primary/Secondary Server. The Active Directory, LDAP, and RADIUS authentication modules now allow one or more servers to be designated as primary or secondary servers.

  When authenticating users from a directory server that is remote to OpenAM, set the primary server values, and optionally, the secondary server values. Primary servers have priority over secondary servers.

  ssoadm attributes are: primary is iplanet-am-auth-ldap-server; secondary is iplanet-am-auth-ldap-server2.

  Both properties take more than one value; thus, allowing more than one primary or secondary remote server, respectively. Assuming a multi-data center environment, OpenAM determines priority within the primary and secondary remote servers, respectively, as follows:

  • Every LDAP server that is mapped to the current OpenAM instance has highest priority.

    For example, if you are connected to openam1.example.com and ldap1.example.com is mapped to that OpenAM instance, then OpenAM uses ldap1.example.com.

  • Every LDAP server that was not specifically mapped to a given OpenAM instance has the next highest priority.

    For example, if you have another LDAP server, ldap2.example.com, that is not connected to a specific OpenAM server and if ldap1.example.com is unavailable, OpenAM connects to the next highest priority LDAP server, ldap2.example.com.

  • LDAP servers that are mapped to different OpenAM instances have the lowest priority.

    For example, if ldap3.example.com is connected to openam3.example.com and ldap1.example.com and ldap2.example.com are unavailable, then openam1.example.com connects to ldap3.example.com.

  For more information, see OPENAM-3575.

• New XUI Reverse Proxy Support Option.

  A new option for controlling caching in the XUI when behind a reverse proxy is available in this release. The option is disabled by default when upgrading to preserve previous behavior, and enabled in clean installs.

  If reverse proxy support in the XUI is required after an upgrade from 12.0.0, delay enabling the XUI Reverse Proxy Support option long enough that cached JavaScript files on end-user clients have expired, for example 30 days. Failure to do so may result in users being redirected to http://null:8080.

• Legacy User Self Service Endpoints Disabled by Default.

  The REST endpoints used by the legacy user self service features, such as registering for an account or resetting a forgotten password, are now disabled by default.

  Legacy deployments should migrate to the new user self-service features in OpenAM 13, see Chapter 8, "Configuring User Self-Service Features" in the Administration Guide.

  To restore the legacy endpoints, enable the Configuration > Global > Legacy User Self Service > Legacy Self-Service REST Endpoint option.

  Warning

  Restoring the legacy self service endpoints allows REST requests crafted such that the body of the self-service email contains a malicious URL that end users may visit, hiding the correct OpenAM URL that is appended to the end of the email body.

• Destination After Successful Self-Registration Option Removed.

  The new user self-service workflow will always display the success page after completing self-registration. The option to choose the behavior has been removed.

• REST Endpoint Changes

  Version 3.0 of the /users endpoint is provided in this release of OpenAM. The response differs from version 2.0 of the endpoint, which remains available for backwards compatibility.

  The new version of the endpoint returns details about all users. The previous version only returned a list of usernames.

  Version 3.0 of the /users endpoint does not support the following _action values:

  https://openam.example.com:8443/openam/json/users/?_action=register
  https://openam.example.com:8443/openam/json/users/?_action=confirm
  https://openam.example.com:8443/openam/json/users/?_action=anonymousCreate
  https://openam.example.com:8443/openam/json/users/?_action=forgotPassword
  https://openam.example.com:8443/openam/json/users/?_action=forgotPasswordReset

  Responses to Different Versions of the /users Endpoint

  In this section, long URLs are wrapped to fit the printed page, and some of the output is formatted or truncated for easier reading.

  Version 3.0 of the /users endpoint:

  $ curl \
  --header "iPlanetDirectoryPro: AQIC5w...2NzEz*" \
  --header Accept-API-Version: protocol=1.0,resource=3.0 \
  "https://openam.example.com:8443/openam/json/users?_queryId=*"
  {
    "result": [
      {
        "username": "amAdmin",
        "realm": "dc=openam,dc=forgerock,dc=org",
        "sn": [
          "amAdmin"
        ],
        "givenName": [
          "amAdmin"
        ],
        "universalid": [
          "id=amAdmin,ou=user,dc=openam,dc=forgerock,dc=org"
        ],
        "cn": [
          "amAdmin"
        ],
        "roles": [
          "ui-global-admin",
          "ui-realm-admin"
        ],
        "inetuserstatus": [
          "Active"
        ],
        "dn": [
          "uid=amAdmin,ou=people,dc=openam,dc=forgerock,dc=org"
        ]
      },
      {
        "username": "demo",
        "realm": "dc=openam,dc=forgerock,dc=org",
        "uid": [
          "demo"
        ],
        "createTimestamp": [
          "20160108155628Z"
        ],
        "inetUserStatus": [
          "Active"
        ],
        "mail": [
          "demo.user@example.com"
        ],
        "sn": [
          "demo"
        ],
        "cn": [
          "demo"
        ],
        "objectClass": [
          "devicePrintProfilesContainer",
          "person",
          "iplanet-am-auth-configuration-service",
          "sunFMSAML2NameIdentifier",
          "organizationalperson",
          "inetuser",
          "kbaInfoContainer",
          "forgerock-am-dashboard-service",
          "iplanet-am-managed-person",
          "iplanet-am-user-service",
          "sunAMAuthAccountLockout",
          "top"
        ],
        "kbaInfo": [
          {
            "questionId": "2",
            "answer": {
              "$crypto": {
                "value": {
                  "algorithm": "SHA-256",
                  "data": "VXGtsnjJMC...MQJ/goU5hkfF"
                },
                "type": "salted-hash"
              }
            }
          }
        ],
        "dn": [
          "uid=demo,ou=people,dc=openam,dc=forgerock,dc=org"
        ],
        "universalid": [
          "id=demo,ou=user,dc=openam,dc=forgerock,dc=org"
        ],
        "modifyTimestamp": [
          "20160113010610Z"
        ]
      }
    ],
    "resultCount": 2,
    "pagedResultsCookie": null,
    "totalPagedResultsPolicy": "NONE",
    "totalPagedResults": -1,
    "remainingPagedResults": -1
  }

  Version 2.0 of the /users endpoint:

  $ curl \
  --header "iPlanetDirectoryPro: AQIC5w...2NzEz*" \
  --header Accept-API-Version: protocol=1.0,resource=2.0 \
  "https://openam.example.com:8443/openam/json/users?_queryId=*"
  {
      "result": [
          "amAdmin",
          "demo"
      ],
      "resultCount": 2,
      "pagedResultsCookie": null,
      "totalPagedResultsPolicy": "NONE",
      "totalPagedResults": -1,
      "remainingPagedResults": -1
  }

• Workaround for java.lang.VerifyError in WebSphere.

  When loading classes from OpenAM within WebSphere Application Server using the IBM Technology for JVM and Apache Axis2 framework, a java.lang.VerifyError JVMVRFY013 class loading constraint violated error may occur. For more information on the java.lang.VerifyError error, see "java.lang.VerifyError: JVMVRFY013 class loading constraint violated" Error.

  Procedure 4.2. Fixing a WebSphere java.lang.VerifyError Error

  1. Remove the following JARs from the WEB-INF/lib directory in the openam.war file:

     • jaxp-api-1.4.2.jar

     • xercesImpl-2.11.0.jar

     • xml-apis-2.11.0.jar

     • xml-resolver-2.11.0.jar

     • xml-serializer-2.11.0.jar

     For instructions on how to expand the openam.war file, make changes to bootstrap.properties file, and then rebuild the openam.war file, see Procedure 1.6, "To Prepare OpenAM for JBoss and WildFly" in the Installation Guide.

  2. Set the following custom JVM properties on the WebSphere server:

     -Djavax.xml.soap.MessageFactory=com.sun.xml.internal.messaging.saaj.soap.ver1_1.SOAPMessageFactory1_1Impl
     -Djavax.xml.soap.SOAPFactory=com.sun.xml.internal.messaging.saaj.soap.ver1_1.SOAPFactory1_1Impl
     -Djavax.xml.soap.SOAPConnectionFactory=com.sun.xml.internal.messaging.saaj.client.p2p.HttpSOAPConnectionFactory
     -Djavax.xml.soap.MetaFactory=com.sun.xml.internal.messaging.saaj.soap.SAAJMetaFactoryImpl
     -Dcom.ibm.websphere.webservices.DisableIBMJAXWSEngine=true 

  3. Restart the WebSphere server.

• Different return type for GetUserInfo method of ScopeValidator interface.

  The return type for the getUserInfo method of the org.forgerock.oauth2.core.ScopeValidator interface, formerly Map<String, Object>, is now org.forgerock.oauth2.core.UserInfoClaims. The new return type lets callers of the getUserInfo method see values of users' claims.

  This change affects OAuth 2.0 scope validator plugins. For more information, see Section 4.2, "Customizing OAuth 2.0 Scope Handling" in the Developer's Guide.

• Oracle Directory Server Enterprise Edition no longer supported for the OpenAM configuration store.

  In previous versions, it was possible to deploy the OpenAM configuration store in an external Oracle Directory Server Enterprise Edition instance.

  In OpenAM 13, this is no longer possible. You must deploy the OpenAM configuration store in an OpenDJ server instance: either the embedded OpenDJ directory server instance that is installed together with OpenAM, or in an external server instance.

• .NET Fedlet Documentation Moved: The .NET Fedlet documentation is now a KB article available to ForgeRock customers.

• The following REST endpoints have been deprecated from OpenAM and will be removed in a future release:

  • /identity/attributes

  • /identity/authenticate

  • /identity/authorize

  • /identity/create

  • /identity/delete

  • /identity/isTokenValid

  • /identity/logout

  • /identity/read

  • /identity/search

  • /identity/update

  For more information on deprecated and removed endpoints, see How Do I know which endpoint to use for REST calls in new versions of OpenAM/AM? in the ForgeRock Knowledge Base.

• The OpenAM Logging, User Self Service, and Password Reset Services are deprecated. The User Self Service has been renamed to Legacy User Self Service. New audit logging and user self-service capabilities are available in OpenAM 13.0.0. See Section 1.1.8, "Platform Features" for more information.

• The classic JATO-based UI is deprecated for the end-user pages and replaced in OpenAM with the JavaScript-based XUI as a replacement. The classic UI for end user pages is likely to be removed in a future release.

• Listing tokens with the /frrest/oauth2/token/?_queryId method is deprecated. Improved _queryFilter support will be added to replace the _queryId method.

• The Device Print Service is deprecated. For information on replacement device identification features, see Section 2.4.7, "Hints for the Device ID (Match) Authentication Module" in the Administration Guide.

• The /identity endpoints that were not previously deprecated are no longer in OpenAM:

  • /log

  • /getCookieNamesForToken

  • /getCookieNamesToForward

• Use of the legacy Netscape LDAP SDK is replaced by the OpenDJ SDK.

• The sun-idrepo-ldapv3-config-connection-mode property replaces sun-idrepo-ldapv3-config-ssl-enabled, which has been removed from the configuration schema (sunIdentityRepositoryService).

  For more information, see OPENAM-3714.

• The openam-auth-ldap-connection-mode property replaces iplanet-am-auth-ldap-ssl-enabled, which has been removed from the configuration schema (sunAMAuthADService and iPlanetAMAuthLDAPService).

  For more information, see OPENAM-5097.

• New openam.deserialisation.classes.whitelist Property. OpenAM uses the JATO framework for some console pages and for legacy login pages. The JATO framework uses serialized Java objects to maintain state during the console session.

  To ensure that the serialized objects have not been exploited by a malicious user, OpenAM now provides a new openam.deserialisation.classes.whitelist property that lists valid classes when OpenAM performs object deserialization. The default should work for most deployments.

  You can access and update the property on the OpenAM console by navigating to Configuration > Servers and Sites > Default Server Settings > Security > Object Deserialisation Class Whitelist.

  For more information, see OPENAM-5925.

• REST services relying on the following endpoints have been removed from OpenAM.

  • /identity/attributes

  • /identity/authenticate

  • /identity/authorize

  • /identity/create

  • /identity/delete

  • /identity/isTokenValid

  • /identity/logout

  • /identity/read

  • /identity/search

  • /identity/update

  • /json/[realm/]referrals

  • /ws/1/entitlement/decision

  • /ws/1/entitlement/decisions

  • /ws/1/entitlement/entitlement

  • /ws/1/entitlement/entitlements

  • /ws/1/entitlement/listener

  • /ws/1/entitlement/privilege

  • /ws/1/token

• The Persistent Cookie (Legacy) settings in the Core Authentication module have been removed, along with the following properties:

  • com.iplanet.am.cookie.timeToLive

  • openam.session.allow_persist_am_cookie

  • openam.session.persist_am_cookie

  For information on how to configure persistent cookies in this release, see Section 2.4.19, "Hints for the Persistent Cookie Module" in the Administration Guide.

• The server-only WAR file has been removed from the OpenAM distribution.

• The Distributed Authentication Service (DAS) has been removed.

• Referral policies are no longer available in OpenAM. If you are upgrading from a previous version of OpenAM and currently use referral policies, please refer to the Upgrade Guide for migration information.

• Specifying a realm in POST data is no longer supported. A number of other methods are supported, such as specifying the realm as a query parameter.

• Cached JavaScript Files from OpenAM 12.0.0 May Cause Redirect to undefined:8080. If you configure an OpenAM 12.0.0 instance with long-lived cache times for the /XUI/index.html file, you may experience unexpected redirects to undefined:8080 after upgrading to OpenAM 13.

  To work around this issue, in your chosen web container, or proxy server, reconfigure the cache time for the /XUI/index.html file to be short-lived, for example, 5 minutes. Allow enough time that cached files with the long-lived cache time will have expired before upgrading to OpenAM 13.

  Note

  This issue does not affect upgrades from OpenAM 12.0.1 or later. OpenAM 12.0.1 and later set a short-lived cache-control header on UI files to work around the problem of having stale files cached locally.

• RADIUS Service Only Supports Commons Audit Logging. The new RADIUS service only supports the new Commons Audit Logging, available in this release. The RADIUS service cannot use the older Logging Service, available in releases prior to OpenAM 13.0.0.

• Administration Console Access Requires the RealmAdmin privilege . In OpenAM 13, administrators can use the OpenAM administration console as follows:

  • Delegated administrators with the RealmAdmin privilege can access full administration console functionality within the realms they can administer. In addition, delegated administrators in the Top Level Realm who have this privilege can access OpenAM's global configuration.

  • Administrators with lesser privileges, such as the PolicyAdmin privilege, can not access the OpenAM administration console.

  • The top-level administrator, such as amadmin, has access to full console functionality in all realms and can access OpenAM's global configuration.

• Do Not End Policy Names with a "/" Character. Do not use a "/" character at the end of a policy name as it will cause OpenAM to not read, edit, or delete the policy.

  After upgrade, users who have policies with a trailing slash "/" character at the end of a policy name should remove the slash (OPENAM-5400). ways:

  To remove slashes in the policy names, remove them as recommended in: OPENAM-5187.

• Upgrade Incorrectly Sets Default Value for the REST APIs Service. The workaround is to manually set the default version setting in the REST APIs service to the preferred value:

  $ openam/bin/ssoadm set-attr-defs -s RestApisService -t Global \
       -a openam-rest-apis-default-version=Latest -u amadmin -f .pass
      

  For background information, see OPENAM-6302.

• OAuth2 Scopes Behavior Affected by Upgrade. After an upgrade, OAuth 2.0 scope behavior uses a deprecated implementation class, org.forgerock.openam.oauth2.provider.impl.ScopeImpl.

  The workaround is to manually update the OAuth 2.0 providers to use the org.forgerock.openam.oauth2.OpenAMScopeValidator.

  For background information, see OPENAM-6319.

• Different OpenAM Version within a Site. Do not run different versions of OpenAM together in the same OpenAM site.

• Avoid Use of Special Characters in Policy or Application creation. Do not use special characters within policy, application or referral names (for example, "my+referral") using the Policy Editor or REST endpoints as OpenAM returns a 400 Bad Request error. The special characters are: double quotes ("), plus sign (+), command (,), less than (<), equals (=), greater than (>), backslash (\), and null (\u0000). (OPENAM-5262)

• Avoid Using REST Endpoint Names for Realm Names. Do not use the names of OpenAM REST endpoints as the name of a realm. The OpenAM REST endpoint names that should not be used includes: "users", "groups", "realms", "policies" and "applications". (OPENAM-5314)

• Deploying OpenAM on Windows in an IPv6 Network. When deploying OpenAM components on Microsoft Windows in an IPv6 environment, you must use the Java 7 Development Kit on Windows (due to JDK-6230761, which is fixed only in Java 7).

• Database Repository Type is Experimental. The Database Repository type of data store is experimental and not supported for production use.

• Enforcing Session Quotas with Session Failover. By default OpenAM does not enforce session quotas when running in Site mode without session failover. To work around this behavior, set the server configuration property openam.session.useLocalSessionsInMultiServerMode=true. You can set this property in OpenAM console under Configuration > Servers and Sites > Servers > Server Name > Advanced.

• XACML Policy Import and Export. OpenAM can only import XACML 3.0 files that were either created by an OpenAM instance, or that have had minor manual modifications, due to the reuse of some XACML 3.0 parameters for non-standard information.

• Custom Profile Attributes Are Visible in the User Profile Only With the Classic UI. The ability to view and edit custom profile attributes is limited to the classic UI. Custom profile attributes do not appear in the user profile when users log in to OpenAM using the XUI.