#
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
#
# Copyright 2012-2016 ForgeRock AS.
#
# The contents of this file are subject to the terms
# of the Common Development and Distribution License
# (the License). You may not use this file except in
# compliance with the License.
#
# You can obtain a copy of the License at
# http://forgerock.org/license/CDDLv1.0.html
# See the License for the specific language governing
# permission and limitations under the License.
#
# When distributing Covered Code, include this CDDL
# Header Notice in each file and include the License file
# at http://forgerock.org/license/CDDLv1.0.html
# If applicable, add the following below the CDDL Header,
# with the fields enclosed by brackets [] replaced by
# your own identifying information:
# "Portions copyright [year] [name of copyright owner]"
#

#
# Portions Copyrighted 2014-2016 Nomura Research Institute, Ltd.
#

forgerock-oauth2-provider-description=OAuth2 Provider

# Global settings
g101=OpenID Connect Claims extension Script Timeout
g101.help=The maximum execution time any individual script should take on the server (in seconds).
g101.help.txt=Scripts will be forcibly stopped after this amount of execution time.
g102=Core thread pool size
g102.help=The core size of the thread pool from which scripts will operate.
g103=Maximum thread pool size
g103.help=The maximum size of the thread pool from which scripts will operate.
g103.help.txt=New threads will be created up to this size once the task queue reaches capacity. Has no effect if the \
  queue is unbounded.
g104=Thread pool queue size
g104.help=Size of queue to use for buffering script execution request when core pool is at capacity.
g104.help.txt=Use -1 for an unbounded queue (this disables the maximum pool size setting). For short, CPU-bound \
  scripts, consider a small pool size and larger queue length. For I/O-bound scripts (e.g., REST calls) consider \
  a larger maximum pool size and a smaller queue. Not hot-swappable: restart server for changes to take effect.
g105=Thread idle timeout (seconds)
g105.help=Length of time (in seconds) to wait before terminating threads.
g105.help.txt=Length of time (in seconds) to wait before terminating threads that were started when the queue reached \
  capacity. Only applies to threads beyond the core pool size (up to the maximum size).
g106=Java class whitelist
g106.help=List of patterns of allowed Java classes that may be loaded/accessed by scripts.
g106.help.txt=Each Java class accessed by a script must match at least one of these patterns. Use '*' as a wildcard, \
  e.g. <code>java.lang.*</code>
g107=Java class blacklist
g107.help=List of patterns of Java classes that must not be accessed by a script.
g107.help.txt=This blacklist is applied after the whitelist to apply additional restrictions. For instance you may \
  whitelist java.lang.* and then blacklist java.lang.System and java.lang.Runtime. It is recommended to always prefer \
  specific whitelists where possible.
g108=Use system SecurityManager
g108.help=Indicates whether the system SecurityManager should also be consulted when checking access to Java classes.
g108.help.txt=If enabled, then the checkPackageAccess method will be called for each Java class accessed. If no \
  SecurityManager is configured, then this has no effect.

a099=Use Stateless Access & Refresh Tokens
a099.help=Enable to issue stateless access & refresh tokens that can be introspected by resource servers.
a100=Authorization Code Lifetime (seconds)
a100.help=The time in seconds an authorization code is valid for
a101=Refresh Token Lifetime (seconds)
a101.help=The time in seconds a refresh token is valid for. If this field is set to -1, the token \
 will never expire.
a102=Access Token Lifetime (seconds)
a102.help=The time in seconds an access token is valid for
a103=Issue Refresh Tokens
a103.help=Check to enable generation of refresh tokens
a103a=Issue Refresh Tokens on Refreshing Access Tokens
a103a.help=Check to enable generation of refresh tokens when refreshing access tokens
a103b=Custom Login URL Template
a103b.help=A Freemarker template which will create a custom URL for the login page to authenticate the resource owner. \
  The following values are available to the Freemarker template: gotoUrl - the URL to redirect back to the OAuth2 \
  authorization process, acrValues - the acr values for the OAuth2 authorization request, realm - the OpenAM realm \
  the OAuth2 authorization request was made on, module - the name of the OpenAM authentication module requested to \
  perform resource owner authentication, service - the name of the OpenAM authentication chain requested to perform \
  resource owner authentication, locale - a space separated list of locales ordered by preference.
a104=Scope Implementation Class
a104.help=The class that contains the required scope implementation, must implement the \
  <code>org.forgerock.oauth2.core.ScopeValidator</code> interface
a104aa=OIDC Claims Script
a104aa.help=This is a script that will be run, when using an implementation of the \
  org.forgerock.openam.oauth2.OpenAMScopeValidator, when issuing an ID Token or making a request to the userinfo \
  endpoint that will gather and fill in all claims for the request. The script has access to the requested scopes, \
  the access token, the user's session (if available), the user's identity.
a104ab=OIDC Claims Script Type
a104ab.help=This is the language of the OIDC claims script.
scriptGroovyChoice=Groovy
scriptJavaScriptChoice=JavaScript
a105=Response Type Plugins
a105.help=Response types are input as such, code|name of plugin class. For example, code|org.forgerock.oauth2.core.TokenResponseTypeHandler. \
If there is no implementation class none should be used in place of the class name. For example id_token|none.
a106=User Profile Attribute(s) the Resource Owner is Authenticated On
a106.help=If the attribute is mail and uid, then a search string of (|(mail=user)(uid=user)) will be used to get the \
user profile, where user is the username entered during authentication.
a107=Saved Consent Attribute Name
a107.help=To use saved consent a list attribute must be set up and the attribute name provided.
a1075=User Display Name attribute
a1075.help=The attribute for identities retrieved from the ID Repository that contains a displayable name for the user \
  for use in the consent page.
a108=Supported Scopes
a108.help=A list of scopes this authorization server supports, with translations.
a108.help.txt=Scopes may be entered as simple strings or pipe separated strings representing the internal scope name, \
  locale, and localized description; e.g. "read|en|Permission to view email messages in your account". Locale strings \
  are in the format <code>language + "_" + country + "_" + variant</code>, e.g. en, en_GB, en_US_WIN. \
  If the locale and pipe is omitted, the description is displayed to all users having undefined locales. \
  e.g. "read|Permission to view email messages in your account". \
  <i>NB</i> If the description is also omitted, nothing is displayed to all users, e.g. specifying "read|" would allow \
  the scope "read" to be used by the client, but would not display it to the user when it was requested.

a109=Remote JSON Web Key URL
a109.help=The Remote URL where the providers JSON Web Key can be retrieved.
a110=Subject Types supported
a110.help=List of subject types supported. Valid values are pairwise and public.
a111=ID Token Signing Algorithms supported
a111.help=Algorithms supported to sign id_tokens.
a111a=ID Token Encryption Algorithms supported
a111a.help=Algorithm supported to encrypt OpenID Connect ID tokens in order to hide its contents.
a111a.help.txt=Available encryption algorithms are:<br>\
  RSA1_5 - RSA with PKCS#1 v1.5 padding (not recommended).<br>\
  RSA-OAEP - RSA with Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF-1.<br>\
  RSA-OAEP-256 - RSA with OAEP with SHA-256 and MGF-1.<br>\
  dir - Direct encryption with AES using the hashed client secret.<br>\
  A128KW - AES Key Wrapping with 128-bit key derived from the client secret.<br>\
  A192KW - AES Key Wrapping with 192-bit key derived from the client secret.<br>\
  A256KW - AES Key Wrapping with 256-bit key derived from the client secret.
a111b=ID Token Encryption Methods supported
a111b.help=Encryption methods supported to encrypt OpenID Connect ID tokens in order to hide its contents.
a111b.help.txt=Available encryption methods are:<br>\
  A128CBC-HS256, A192CBC-HS384 and A256CBC-HS512 - AES encryption in CBC mode with HMAC-SHA-2 for integrity.<br>\
  A128GCM, A192GCM and A256GCM - AES in Galois Counter Mode (GCM) authenticated encryption mode.
a112=Supported Claims
a112.help=List of claims supported by the userinfo endpoint, with translations.
a112.help.txt=Claims may be entered as simple strings or pipe separated strings representing the internal claim name, \
  locale, and localized description; e.g. "name|en|Your full name". Locale strings \
  are in the format <code>language + "_" + country + "_" + variant</code>, e.g. en, en_GB, en_US_WIN. \
  If the locale and pipe is omitted, the description is displayed to all users having undefined locales. \
  e.g. "name|Your full name". \
  <i>NB</i> If the description is also omitted, nothing is displayed to all users, e.g. specifying "name|" would allow \
  the claim "name" to be used by the client, but would not display it to the user when it was requested.

a113=OpenID Connect JWT Token Lifetime (seconds)
a113.help=The amount of time in seconds the JWT will be valid for.
a113a=OAuth2 Token Signing Algorithm
a113a.help=Algorithm used to sign stateless OAuth2 tokens in order to detect tampering.
a113a.help.txt=NONE - No signature.<br/>\
  HS256 - HMAC using SHA-256 hash algorithm.<br/>\
  HS384 - HMAC using SHA-384 hash algorithm.<br/>\
  HS512 - HMAC using SHA-512 hash algorithm.<br/>\
  RS256 - RSA using SHA-256 hash algorithm.<br/>\
  ES256 - ECDSA using SHA-256 hash algorithm.<br/>\
  ES384 - ECDSA using SHA-384 hash algorithm.<br/>\
  ES512 - ECDSA using SHA-512 hash algorithm.
a113b=Token Signing HMAC Shared Secret
a113b.help=Base64 encoded key used by HS256, HS384 and HS512.
a114=Token Signing RSA public/private key pair
a114.help=The public/private key pair used by RS256.
a114.help.txt=The public/private key pair will be retrieved from the keystore referenced by the property \
  com.sun.identity.saml.xmlsig.keystore
a114a=Token Signing ECDSA public/private key pair alias
a114a.help=The list of public/private key pairs used for the elliptic curve algorithms (ES256/ES384/ES512). \
  Add an entry to specify an alias for a specific elliptic curve algorithm, e.g. "ES256|es256Alias
a114a.help.txt=Each of the public/private key pairs will be retrieved from the keystore referenced by the property \
  com.sun.identity.saml.xmlsig.keystore
a115=Allow Open Dynamic Client Registration
a115.help=Allow clients to register without an access token. If enabled, you should consider adding some form of rate \
  limiting. See <a href="http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration" \
  target="_blank">Client Registration</a> in the OpenID Connect specification for details.
a116=Generate Registration Access Tokens
a116.help=Whether to generate Registration Access Tokens for clients that register via open dynamic client \
  registration. Such tokens allow the client to access the <a \
  href="http://openid.net/specs/openid-connect-registration-1_0.html#ClientConfigurationEndpoint" \
  target="_blank">Client Configuration Endpoint</a> as per the OpenID Connect specification. This setting has \
  no effect if open dynamic client registration is disabled.
a117=OpenID Connect acr_values to Auth Chain Mapping
a117.help=Maps OpenID Connect ACR values to authentication chains. See <a \
  href="http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" target="_blank">the acr_values parameter</a> \
  in the OpenID Connect authentication request specification for more details.
a118=OpenID Connect default acr claim
a118.help=Default value to use as the 'acr' claim in an OpenID Connect ID Token when using the default authentication \
  chain.
a119=OpenID Connect id_token amr values to Auth Module mappings
a119.help=If you require <code>amr</code> values to be returned in the OpenID Connect <code>id_token</code>, you can \
  configure them here. Once authentication has completed, the authentication modules that were used from the \
  authentication service will be mapped to the <code>amr</code> values. If you do not require <code>amr</code> values, or are not \
  providing OpenID Connect tokens at all, this field can be left blank.
a120=Modified Timestamp attribute name
a120.help=The attribute name of the modified timestamp in the identity repository (must also be added to the User \
  Attributes List on the Datastore Service page).
a121=Created Timestamp attribute name
a121.help=The attribute name of the created timestamp in the identity repository (must also be added to the User \
  Attributes List on the Datastore Service page).
a122=Default Client Scopes
a122.help=List of scopes a client will be granted if they request registration without specifying which scopes they \
  want. Default scopes are NOT auto-granted to clients created through the administrator interface.
a123=Enable "claims_parameter_supported"
a123.help=If enabled, clients will be able to request individual claims using the "claims" Request Parameter \
  as per <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" target="_blank">\
  section 5.5 of the OpenID Connect specification</a>.
a124=Subject identifier hash salt
a124.help=If pairwise subject types are supported, it is STRONGLY RECOMMENDED to set this value. It is used in \
  the salting of hashes for returning specific sub claims to individuals using the same request_uri or \
  sector_identifier_uri.
a125=Always return claims in ID Tokens
a125.help=All id_tokens will contain scope-derived claims. Warning: not strictly spec-compliant.
a125.help.txt=The <a href="http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims">OpenID Connect \
  specification</a> is ambiguous whether scope-derived claims should always be added to the ID Token. This is \
  disabled by default in order to guarantee compliance, but can be enabled for situations where calling the \
  userinfo endpoint is not practical, but an access token is still wanted.
a126=Code verifier parameter required
a126.help=If enabled, Authorization Code requests will require a "code_challenge" attribute
a126.help.txt=The spec for this feature can be found <a href="https://tools.ietf\
  .org/html/draft-ietf-oauth-spop-12">here</a>
a127=Verification URL
a127.help=The URL that the user will be instructed to visit to complete their OAuth 2 login and consent when using \
  the device code flow.
a128=Device Completion URL
a128.help=The URL that the user will be sent to on completion of their OAuth 2 login and consent when using \
  the device code flow.
a129=Device Code Lifetime (seconds)
a129.help=The lifetime of the device code.
a130=Device Polling Interval
a130.help=The polling frequency for devices waiting for tokens when using the device code flow.
a131=Store Ops Tokens
a131.help=When this setting is enabled OpenAM will store the ops tokens corresponding to OIDC sessions in the CTS \
  store. Note that session management related endpoints will not work when this setting is disabled.
a132=Allow clients to skip consent
a132.help=If enabled, clients may be configured so that the resource owner will not be asked for consent during \
  authorization flows.
a133=Enable Token Blacklisting
a133.help=If enabled then tokens will be blacklisted on the server on delete until the token expires.
a133.help.txt=It is recommended to enable this setting if the maximum token expiry time is high. State is stored in \
  the core token store (CTS) until the token expires in order to ensure that tokens cannot continue to \
  be used. Requires a server restart for changes to take effect.
a134=Token Blacklist Cache Size
a134.help=Number of blacklisted tokens to cache in memory to speed up blacklist checks and reduce load on the CTS.
a135=Blacklist Poll Interval (seconds)
a135.help=How frequently to poll for token blacklist changes from other servers, in seconds.
a135.help.txt=How often each server will poll the CTS for token blacklist changes from other servers. This is used \
  to maintain a highly compressed view of the overall current token blacklist improving performance. A lower number\
  will reduce the delay for blacklisted tokens to propagate to all servers at the cost of increased CTS load. Set \
  to 0 to disable this feature completely.
a136=Blacklist Purge Delay (minutes)
a136.help=Length of time to blacklist tokens beyond their expiry time.
a136.help.txt=Allows additional time to account for clock skew to ensure that a token has expired before it is \
  removed from the blacklist.
a138=Stateless Token Compression
a138.help=Whether stateless access/refresh tokens should be compressed
choiceHS256=HS256
choiceHS384=HS384
choiceHS512=HS512
choiceRS256=RS256
choiceES256=ES256
choiceES384=ES384
choiceES512=ES512
a137=Idtokeninfo endpoint requires client authentication
a137.help=When this setting is enable /oauth2/idtokeninfo endpoint requires client authentication \
  if the signature algorithm is HS256/HS384/HS512
a139=Allow ID Tokens as SSOTokens
a139.help=Whether to allow ID Tokens issued by OpenAM to be used as SSOTokens in REST calls.
a139.help.txt=If enabled Store Ops Tokens must also be enabled.
i18nTrue=Yes
i18nFalse=No
