How do I know what LDAP attributes are used by CTS tokens (OAuth2 and session) in AM (All versions)?

Overview

This is the first article in a two-part series, which is designed to help you understand CTS token types (OAuth2 and session) in AM. See How do I know what OAuth2 and session token types are stored in the CTS in AM (All versions)? for the second part.

For SAML2 tokens, see How are SAML2 tokens stored in the CTS in AM (All versions)?

LDAP searches

You can use the information in these articles to query the CTS using ldapsearch, where this article provides the LDAP attributes and the other article provides the data format. For example, if you want to list user OAuth2 refresh tokens, you would filter on coreTokenString03=<user> and coreTokenString10=refresh_token. For example:

• DS 7 and later: $ ./ldapsearch --hostname ds1.example.com --port 1389 --bindDN uid=admin --bindPassword password --baseDN "ou=famrecords,ou=openam-session,ou=tokens,dc=openam,dc=forgerock,dc=org" "(&(coreTokenString03=demo)(coreTokenString10=refresh_token))"
• Pre-DS 7: $ ./ldapsearch --hostname ds1.example.com --port 1389 --bindDN "cn=Directory Manager" --bindPassword password --baseDN "ou=famrecords,ou=openam-session,ou=tokens,dc=openam,dc=forgerock,dc=org" "(&(coreTokenString03=demo)(coreTokenString10=refresh_token))"

LDAP attributes used by tokens

The CTS uses a generic LDAP schema for all token types.

The following sections describe which tokens use which LDAP attributes and for what purpose:

• OAuth2 Grant-Set Tokens (AM 6.5 and later) - replacement for pre-AM 6.5
• Stateless OAuth2 Tokens (AM 5.5 and later) - replacement for pre-AM 5.5:
  • Stateless Access Code token
  • Stateless OAuth2 Grant token
• OAuth2 Tokens (AM 5 and 5.1.x):
  • Access Code token
  • Stateless OAuth2 Access token
  • Stateless OAuth2 Refresh token
• Other OAuth2 tokens:
  • Stateful OAuth2 Access token
  • Stateful OAuth2 Refresh token
  • OpenID Connect OPS token
  • OAuth2 Device Code token
• Session Tokens:
  • CTS-based Session token
  • Client-based Session Blacklist token

OAuth2 Grant-Set Tokens (AM 6.5 and later)

The following table details which LDAP attributes are used by OAuth2 Grant-Set tokens in AM 6.5 and later, where:

• Items shown in bold are static values that all tokens of that type have in common (these are used to identify the token type).
• Items shown in italic describe the type of data that is contained in the given LDAP attribute.

Stateless OAuth2 Tokens (AM 5.5 and later)

The following table details which LDAP attributes are used by stateless OAuth2 tokens in AM 5.5 and later, where:

• Items shown in bold are static values that all tokens of that type have in common (these are used to identify the token type).
• Items shown in italic describe the type of data that is contained in the given LDAP attribute.

OAuth2 Tokens (AM 5 and 5.1.x)

The following table details which LDAP attributes are used by OAuth2 tokens in pre-AM 5.5, where:

• Items shown in bold are static values that all tokens of that type have in common (these are used to identify the token type).
• Items shown in italic describe the type of data that is contained in the given LDAP attribute.

Other OAuth2 Tokens

The following table details which LDAP attributes are used by other OAuth2 tokens in AM, where:

• Items shown in bold are static values that all tokens of that type have in common (these are used to identify the token type).
• Items shown in italic describe the type of data that is contained in the given LDAP attribute.

Session Tokens

The following table details which LDAP attributes are used by session tokens, where:

• Items shown in bold are static values that all tokens of that type have in common (these are used to identify the token type).
• Items shown in italic describe the type of data that is contained in the given LDAP attribute.

See Also

Core Token Service (CTS) and sessions in AM

Core Token Service Guide (CTS)

Maintenance Guide › SNMP CTS Object Identifiers

Related Training

N/A

Related Issue Tracker IDs

N/A