AM 5, 5.1.x and OpenAM 13.5.1 cannot access external CTS after configuration is changed via the console

Last updated Apr 12, 2021

The purpose of this article is to provide assistance if AM/OpenAM cannot access the external Core Token Service (CTS) after the configuration has been changed via the console. You will also see a "CTS: Configuration was invalid" error in your logs when this happens.


This article has been archived and is no longer maintained by ForgeRock.


AM/OpenAM cannot access the external CTS store after configuration changes are made via the console (using either the CTS or Advanced option under Server Defaults). You are unable to access the console If AM/OpenAM is restarted after saving your configuration changes.

You will see the following error in the AM CoreSystem debug logs:

Caused by: java.lang.RuntimeException: CTS: Configuration was invalid at org.forgerock.openam.core.guice.CoreGuiceModule.getCTSWorkerExecutorService( at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke( at sun.reflect.DelegatingMethodAccessorImpl.invoke( at java.lang.reflect.Method.invoke( at at at$4$ at at$4.get( at$1.get( at at at at

If you check the CTS configuration via the console, you will notice the bind password field is empty; similarly, the bind password ( will also be missing from DS/OpenDJ.

On the DS/OpenDJ side, you will see failures in the access log similar to the following:

[21/Oct/2017:15:21:29 +0100] BIND REQ conn=11 op=0 msgID=1 version=3 type=SIMPLE dn="cn=Directory Manager" [21/Oct/2017:15:21:29 +0100] BIND RES conn=11 op=0 msgID=1 result=49 authFailureReason="The password provided by the user did not match any password(s) stored in the user's entry" authDN="cn=Directory Manager" etime=1

Run an ldapsearch against the AM/OpenAM configuration store to check if "" exists, for example:

$./ldapsearch --port 50389 --bindDN "cn=Directory Manager" --bindPassword password --baseDN ou=services,dc=openam,dc=forgerock,dc=org "objectclass=*" | grep ""

If the entry exists, you will see the following sunKeyValue returned with the encrypted password:


Recent Changes

Configured an external CTS via the console.

Made changes to the external CTS configuration using the console.


There is a known issue: OPENAM-11987 (SmsServerPropertiesResource removes password when unchanged.) where saving CTS configuration changes via the console inadvertently removes the saved bind password for the external CTS store, which in turn prevents access to the CTS due to invalid credentials.


This issue can be resolved by upgrading to AM 5.5.1 or later, or OpenAM 13.5.2; you can download this from BackStage.


You can workaround this issue by re-entering the bind password before saving CTS configuration changes in the console or by using ssoadm to update the CTS configuration instead: How do I configure an external CTS token store in AM (All versions) using Amster or ssoadm?

If you have already saved your configuration changes, you can re-enter the password using either the console (providing you have not restarted AM/OpenAM), Amster (AM 5 and later) or ssoadm:

  • Console: navigate to: Configure > Server Defaults > CTS > External Store Configuration > Password and enter the bind password.
  • Amster: follow the steps in How do I update property values in AM (All versions) using Amster?with these values:
    • Entity: CtsDataStoreProperties
    • Property:
  • ssoadm: enter the following command: $ ./ssoadm update-server-cfg -s default -u [adminID] -f [passwordfile] -a[bindPassword] replacing [adminID], [passwordfile] and [bindPassword] with appropriate values.

See Also

How do I configure an external CTS token store in AM (All versions) using Amster or ssoadm?

Related Training


Related Issue Tracker IDs

OPENAM-11987 (SmsServerPropertiesResource removes password when unchanged.)

OPENAM-11834 (Passwords being set to empty strings in tabbed forms in XUI)

OPENAM-11763 ("Saving" CTS configuration overwrites the bind password)

Copyright and Trademarks Copyright © 2021 ForgeRock, all rights reserved.