2N/A<?xml version="1.0" encoding="UTF-8"?>

2N/A<chapter xml:id='chap-config-ref'

2N/A xmlns='http://docbook.org/ns/docbook'

2N/A version='5.0' xml:lang='en'

2N/A xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'

2N/A xsi:schemaLocation='http://docbook.org/ns/docbook http://docbook.org/xml/5.0/xsd/docbook.xsd'

2N/A xmlns:xlink='http://www.w3.org/1999/xlink'>

2N/A <title>Configuration Reference</title>

2N/A

2N/A <indexterm><primary>Configuration</primary></indexterm>

2N/A <para>This chapter covers OpenAM configuration properties accessible through

2N/A the Configuration tab of the console, most of which can be set by using the

2N/A <command>ssoadm</command> command. The chapter is organized to follow the

2N/A OpenAM console layout.</para>

2N/A

2N/A <section xml:id="authentication-configuration">

2N/A <title>Authentication Configuration</title>

2N/A <indexterm>

2N/A <primary>Configuration</primary>

2N/A <secondary>Authentication</secondary>

2N/A </indexterm>

2N/A

2N/A <para>Under Configuration &gt; Authentication you can configure

2N/A authentication services globally using the same attributes you use to

2N/A configure authentication modules per realm under Access Control &gt;

2N/A <replaceable>Realm Name</replaceable> &gt; Authentication &gt; Module

2N/A Instances, and described in the <citetitle>Administration Guide</citetitle>

2N/A chapter on <link xlink:href="admin-guide#chap-auth-services"

2N/A xlink:role="http://docbook.org/xlink/role/olink"><citetitle>Defining

2N/A Authentication Services</citetitle></link>.</para>

2N/A

2N/A <para>The primary difference is that when configuring services globally,

2N/A you set the default values to be used when a module is configured further

2N/A for a specific realm.</para>

2N/A

2N/A <para>The Core Authentication module includes some fields under this tab that are not

2N/A available through the realm changes under the <literal>Access Control</literal> tab.

2N/A Because attributes set under the <literal>Configuration</literal> tab apply on a

2N/A server level, the changes you make here will apply to all realms. Attributes

2N/A set under the <literal>Access Control</literal> tab only apply to the realms that

2N/A you specify. The Authentication table under the <literal>Configuration</literal> tab

2N/A lists all existing types of modules available for configuration, including any

2N/A customized modules you have added.</para>

2N/A

2N/A <para>The following are the global fields you can configure for the Core Authentication

2N/A module under the <literal>Configuration</literal> tab.</para>

2N/A

2N/A <variablelist>

2N/A <varlistentry>

2N/A <term>Pluggable Authentication Module Classes</term>

2N/A <listitem>

2N/A <para>Add class names for custom authentication modules to this list.</para>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-auth-authenticators</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>LDAP Connection Pool Size, Default LDAP Connection Pool Size</term>

2N/A <listitem>

2N/A <para>Sets a minimum and maximum number of LDAP connections in the pool

2N/A for connecting to a directory server. When tuning for production, start

2N/A with <literal>10:65</literal> (10 minimum, 65 maximum). Explicit settings

2N/A for specific servers override the default.</para>

2N/A <para>This attribute is for LDAP and Membership authentication services

2N/A only.</para>

2N/A <para>This connection pool is different than the SDK connection pool

2N/A configured in <filename>serverconfig.xml</filename>.</para>

2N/A <para><command>ssoadm</command> attributes:

2N/A <literal>iplanet-am-auth-ldap-connection-pool-size</literal>, and

2N/A <literal>iplanet-am-auth-ldap-connection-pool-default-size</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>LDAP Connection Pool Size, Default LDAP Connection Pool Size</term>

2N/A <listitem>

2N/A <para>Sets a minimum and maximum number of LDAP connections in the pool

2N/A for connecting to a directory server. When tuning for production, start

2N/A with <literal>10:65</literal> (10 minimum, 65 maximum). Explicit settings

2N/A for specific servers override the default.</para>

2N/A <para>This attribute is for LDAP and Membership authentication services

2N/A only.</para>

2N/A <para>This connection pool is different than the SDK connection pool

2N/A configured in <filename>serverconfig.xml</filename>.</para>

2N/A <para><command>ssoadm</command> attributes:

2N/A <literal>iplanet-am-auth-ldap-connection-pool-size</literal>, and

2N/A <literal>iplanet-am-auth-ldap-connection-pool-default-size</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Remote Auth Security</term>

2N/A <listitem>

2N/A <para>Require the authenticating application to send its SSOToken. This

2N/A allows the Authentication Service to obtain the username and password

2N/A associated with the application.</para>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sunRemoteAuthSecurityEnabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Keep Post Process Objects for Logout Processing, Keep Authentication

2N/A Module Objects for Logout Processing</term>

2N/A <listitem>

2N/A <para>When enabled, retain objects used to process authentication or

2N/A post authentication operations in the user session until the user

2N/A logs out.</para>

2N/A <para><command>ssoadm</command> attributes:

2N/A <literal>sunAMAuthKeepPostProcessInstances</literal>, and

2N/A <literal>sunAMAuthKeepAuthModuleIntances</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>XUI Interface</term>

2N/A <listitem>

2N/A <para>When enabled, the initial login screen uses the XUI.</para>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>openam-xui-interface-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A </section>

2N/A

2N/A <section xml:id="console-configuration">

2N/A <title>Console Configuration</title>

2N/A <indexterm>

2N/A <primary>Configuration</primary>

2N/A <secondary>Console</secondary>

2N/A </indexterm>

2N/A

2N/A <para>Under Configuration &gt; Console you can customize how the OpenAM

2N/A console appears, and what character sets are used.</para>

2N/A

2N/A <variablelist xml:id="console-administration">

2N/A <title>Administration</title>

2N/A

2N/A <para>Administration includes both global and realm attributes.</para>

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetAMAdminConsoleService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Federation Management</term>

2N/A <listitem>

2N/A <para>Clear Enabled to disable federation functionality in OpenAM.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-admin-console-liberty-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Maximum Results Returned from Search</term>

2N/A <listitem>

2N/A <para>Use this attribute to restrict the maximum number of results found

2N/A in a search, such as a search for user profiles. Increasing the value can

2N/A negatively impact performance. On the other hand, the default maximum of

2N/A 100 can explain why administrators unaware of this setting can be

2N/A surprised not to see all the users they expect in search results.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-admin-console-search-limit</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Timeout for Search</term>

2N/A <listitem>

2N/A <para>Timeout in seconds for a console search. OpenAM returns an error

2N/A if the search is not completed by the timeout.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-admin-console-search-timeout</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Search Return Attribute</term>

2N/A <listitem>

2N/A <para>List of LDAP attribute types to return in search results. OpenAM

2N/A sorts users by the first attribute you specify. Use attributes that are

2N/A actually present in user profiles.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-admin-console-user-return-attribute</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Maximum Items Displayed per Page</term>

2N/A <listitem>

2N/A <para>OpenAM shows a maximum of this many items in a console page before

2N/A separating the page into multiple screens.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-admin-console-paging-size</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Prompt user for old password</term>

2N/A <listitem>

2N/A <para>If enabled, when the user edits her password in the user view, then

2N/A OpenAM prompts her for the old password.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-admin-console-password-reset-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="console-g11n">

2N/A <title>Globalization Settings</title>

2N/A

2N/A <para>Globalization settings affect character sets and common name

2N/A formats. See <link xlink:href="reference#chap-l10n"

2N/A xlink:role="http://docbook.org/xlink/role/olink"><citetitle

2N/A >Localization</citetitle></link> for a list of supported locales.</para>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetG11NSettings</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Charsets Supported by Each Locale</term>

2N/A <listitem>

2N/A <para>This table lets you configure the order of supported character

2N/A sets used for each supported locale. Change the settings only if the

2N/A defaults are not appropriate.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-identity-g11n-settings-locale-charset-mapping</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Charsets Aliases</term>

2N/A <listitem>

2N/A <para>Use this list to map between different character set names used in

2N/A Java and in MIME.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-identity-g11n-settings-charset-alias-mapping</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A <varlistentry>

2N/A <term>Auto Generated Common Name Format</term>

2N/A <listitem>

2N/A <para>Use this list to configure how OpenAM formats names shown in the

2N/A console banner.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-identity-g11n-settings-common-name-format</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A </section>

2N/A

2N/A <section xml:id="system-configuration">

2N/A <title>System Configuration</title>

2N/A <indexterm>

2N/A <primary>Configuration</primary>

2N/A <secondary>System</secondary>

2N/A </indexterm>

2N/A

2N/A <para>Under Configuration &gt; System, you can change OpenAM settings for

2N/A server logging, monitoring, service URL naming, locale, cookie domain, and

2N/A how OpenAM detects specific clients.</para>

2N/A

2N/A <variablelist xml:id="system-client-detection">

2N/A <title>Client Detection</title>

2N/A

2N/A <para>OpenAM can detect client user agents by their HTTP requests.</para>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetAMClientDetection</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Default Client Type</term>

2N/A <listitem>

2N/A <para>If no specific match is found for the client type, then this

2N/A type is used. The default is <literal>genericHTML</literal>, suitable

2N/A for supported browsers.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-client-detection-default-client-type</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Client Detection Class</term>

2N/A <listitem>

2N/A <para>The client detection plugin must implement the

2N/A <literal>com.iplanet.services.cdm.ClientDetectionInterface</literal>.

2N/A Client type is a name that uniquely identifies the client to OpenAM.

2N/A The plugin scans HTTP requests to determine the client type.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-client-detection-class</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Enable Client Detection</term>

2N/A <listitem>

2N/A <para>If this is enabled, then OpenAM needs an appropriate client

2N/A detection class implementation, and the authentication user interface

2N/A must be appropriate for the clients detected.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-client-detection-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="system-logging">

2N/A <title>Logging</title>

2N/A

2N/A <para>You configure global OpenAM logging settings on this page.</para>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetAMLoggingService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Maximum Log Size</term>

2N/A <listitem>

2N/A <para>Sets the maximum log file size in bytes.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-max-file-size</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Number of History Files</term>

2N/A <listitem>

2N/A <para>Sets the number of history files for each log that OpenAM keeps,

2N/A including time-based histories. The previously live file is moved to

2N/A be included in the history count, and a new log is created to serve as

2N/A the live log file. Any log file in the history count that goes over

2N/A the number specified here will be deleted. For time-based logs, a new

2N/A set of logs will be created when OpenAM is started because of the time-based

2N/A file names that are used.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-num-hist-file</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logfile Rotation Prefix</term>

2N/A <listitem>

2N/A <para>Set this if you want to add a prefix to log files governed by

2N/A time-based log rotation.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>openam-logging-file-prefix</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logfile Rotation Suffix</term>

2N/A <listitem>

2N/A <para>Changing this if you want to change the suffix for log files

2N/A governed by time-based log rotation. You can use

2N/A <literal>SimpleDateFormat</literal> patterns. The default is

2N/A <literal>-MM.dd.yy-kk.mm</literal>.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>openam-logging-file-suffix</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Log File Location</term>

2N/A <listitem>

2N/A <para>This property is interpreted to determine the location of log

2N/A files, taking either a file system location or a JDBC URL. The default is

2N/A <literal>%BASE_DIR%/%SERVER_URI%/log/</literal>.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-location</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Log Status</term>

2N/A <listitem>

2N/A <para>Set this to <literal>INACTIVE</literal> to disable the logging

2N/A system.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>logstatus</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Log Record Resolve Host Name</term>

2N/A <listitem>

2N/A <para>Enable this to have OpenAM perform a DNS host lookup to populate the

2N/A host name field for log records. OpenAM requires DNS on the host where it

2N/A runs. Enabling this feature increases the load on the logging

2N/A system.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>resolveHostName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logging Type</term>

2N/A <listitem>

2N/A <para>Set this to <literal>DB</literal> to log to a database. Default:

2N/A <literal>File</literal>. If you choose <literal>DB</literal> then be

2N/A sure to set the connection attributes correctly, including the JDBC

2N/A driver to use.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-type</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Database User Name</term>

2N/A <listitem>

2N/A <para>When logging to a database, set this to the user name used to

2N/A connect to the database. If this attribute is incorrectly set, OpenAM

2N/A performance suffers.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-db-user</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Database User Password</term>

2N/A <listitem>

2N/A <para>When logging to a database, set this to the password used to connect

2N/A to the database. If this attribute is incorrectly set, OpenAM performance

2N/A suffers.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-db-password</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Database Driver Name</term>

2N/A <listitem>

2N/A <para>When logging to a database, set this to the class name of the JDBC

2N/A driver used to connect to the database. The default is for Oracle. OpenAM

2N/A also works with the MySQL database driver.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-db-driver</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Configurable Log Fields</term>

2N/A <listitem>

2N/A <para>Select the fields OpenAM includes in log messages using this

2N/A attribute. By default all fields are included in log messages.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-logfields</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Log Verification Frequency</term>

2N/A <listitem>

2N/A <para>When secure logging is enabled, set this to how often OpenAM

2N/A verifies log file content (in seconds).</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-verify-period-in-seconds</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Log Signature Time</term>

2N/A <listitem>

2N/A <para>When secure logging is enabled, set this to how often OpenAM signs

2N/A log file content (in seconds).</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-signature-period-in-seconds</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Secure Logging</term>

2N/A <listitem>

2N/A <para>Set this to <literal>ON</literal> to enable the secure logging

2N/A system whereby OpenAM digitally signs and verifies log files. You must

2N/A also set up the Logging Certificate Store for this feature to

2N/A function.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-security-status</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Secure Logging Signing Algorithm</term>

2N/A <listitem>

2N/A <para>Set this to the algorithm used for digitally signing log

2N/A records.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-secure-signing-algorithm</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logging Certificate Store Location</term>

2N/A <listitem>

2N/A <para>The secure logging system uses the certificate with alias

2N/A <literal>Logger</literal> that it finds in the key store specified by

2N/A this path. The default is

2N/A <literal>%BASE_DIR%/%SERVER_URI%/Logger.jks</literal>.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-secure-certificate-store</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Maximum Number of Records</term>

2N/A <listitem>

2N/A <para>Set this to the maximum number of records read from the logs

2N/A through the Logging API.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-max-records</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Number of Files per Archive</term>

2N/A <listitem>

2N/A <para>Set this to the number of files to be archived by the secure logging

2N/A system.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-files-per-keystore</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Buffer Size</term>

2N/A <listitem>

2N/A <para>The number of log messages buffered in memory before OpenAM flushes

2N/A them to the log file or the database.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-buffer-size</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>DB Failure Memory Buffer Size</term>

2N/A <listitem>

2N/A <para>Set this to the maximum number of log records to hold in memory

2N/A if the database to which records are logged is unavailable. If the value

2N/A is less than Buffer Size, that value takes precedence.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-am-logging-db-max-in-mem</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Buffer Time</term>

2N/A <listitem>

2N/A <para>Set the time in seconds that OpenAM buffers log messages in memory

2N/A before flushing the buffer when Time Buffering is ON. The default is 60

2N/A seconds.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-buffer-time-in-seconds</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Time Buffering</term>

2N/A <listitem>

2N/A <para>Set this to OFF to cause OpenAM to write each log message separately

2N/A rather than the default of holding messages in a memory buffer that OpenAM

2N/A flushes periodically, as specified using the Buffer Time attribute.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-logging-time-buffering-status</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logging Level</term>

2N/A <listitem>

2N/A <para>Set the log level for OpenAM. <literal>OFF</literal> is equivalent

2N/A to setting the status to <literal>INACTIVE</literal>.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-am-log-level</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="system-monitoring">

2N/A <title>Monitoring</title>

2N/A

2N/A <para>You enable OpenAM monitoring by using these attributes.</para>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetAMMonitoringService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring Status</term>

2N/A <listitem>

2N/A <para>Enable monitoring using this attribute.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring HTTP Port</term>

2N/A <listitem>

2N/A <para>Set the port number for the HTML monitoring interface.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-http-port</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring HTTP interface status</term>

2N/A <listitem>

2N/A <para>Enable the HTML monitoring interface using this attribute.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-http-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring HTTP interface authentication file path</term>

2N/A <listitem>

2N/A <para>Set this to path to indicate the file indicating the user name

2N/A and password used to protect access to monitoring information. The

2N/A default user name password combination is <literal>demo</literal> and

2N/A <literal>changeit</literal>. You can encode a new password using the

2N/A <link xlink:href="reference#ampassword-1"

2N/A xlink:role="http://docbook.org/xlink/role/olink"><command

2N/A >ampassword</command></link>command.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-authfile-path</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring RMI Port</term>

2N/A <listitem>

2N/A <para>Set the port number for the JMX monitoring interface.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-rmi-port</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring RMI interface status</term>

2N/A <listitem>

2N/A <para>Enable the JMX monitoring interface using this attribute.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-rmi-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring SNMP Port</term>

2N/A <listitem>

2N/A <para>Set the port number for the SNMP monitoring interface.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-snmp-port</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring SNMP interface status</term>

2N/A <listitem>

2N/A <para>Enable the SNMP monitoring interface using this attribute.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-monitoring-snmp-enabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="system-platform">

2N/A <title>Naming</title>

2N/A

2N/A <para>You can configure URLs for service endpoints.</para>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetAMNamingService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Profile Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the profile service.</para>

2N/A <para>This attribute is deprecated.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-profile-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Session Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the session service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-session-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logging Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the logging service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-logging-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Policy Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the policy service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-policy-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Authentication Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the authentication service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-auth-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SAML Web Profile/Artifact Service URL</term>

2N/A <listitem>

2N/A <para>Set the SAML v1 endpoint.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-samlawareservlet-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SAML SOAP Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the SAML v1 SOAP service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-samlsoapreceiver-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SAML Web Profile/POST Service URL</term>

2N/A <listitem>

2N/A <para>Set the SAML v1 Web Profile endpoint.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-samlpostservlet-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SAML Assertion Manager Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the SAML v1 assertion service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-samlassertionmanager-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Federation Assertion Manager Service URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used by the ID-FF assertion manager service.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-fsassertionmanager-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Security Token Manager URL</term>

2N/A <listitem>

2N/A <para>Set the STS endpoint.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-securitytokenmanager-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>JAXRPC Endpoint URL</term>

2N/A <listitem>

2N/A <para>Set the JAXRPC endpoint used by remote IDM/SMS APIs.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-naming-jaxrpc-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Identity Web Services Endpoint URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint for Identity WSDL services.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-naming-idsvcs-jaxws-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Identity REST Services Endpoint URL</term>

2N/A <listitem>

2N/A <para>Set the endpoint used for Identity REST services.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-naming-idsvcs-rest-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Security Token Service Endpoint URL</term>

2N/A <listitem>

2N/A <para>Set the STS endpoint.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-naming-sts-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Security Token Service MEX Endpoint URL</term>

2N/A <listitem>

2N/A <para>Set the STS MEX endpoint.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>sun-naming-sts-mex-url</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="system-platform-attrs">

2N/A <title>Platform</title>

2N/A

2N/A <para>You can configure the default locale and list of cookie domains.</para>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>iPlanetAMPlatformService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Platform Locale</term>

2N/A <listitem>

2N/A <para>Set the fallback locale used when the user locale cannot be

2N/A determined.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-platform-locale</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Cookie Domains</term>

2N/A <listitem>

2N/A <para>Set the list of domains into which OpenAM writes cookies. If you

2N/A set multiple cookie domains, OpenAM still only sets the cookie in the

2N/A domain the client uses to access OpenAM. You can also configure cross

2N/A domain single sign on (CDSSO) to allow single sign on across multiple

2N/A domains managed by your organization. See the <citetitle>Administration

2N/A Guide</citetitle> chapter on <link xlink:href="admin-guide#chap-cdsso"

2N/A xlink:role="http://docbook.org/xlink/role/olink"><citetitle>Configuring

2N/A Cross-Domain Single Sign On</citetitle></link> for details.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>iplanet-am-platform-cookie-domains</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A </section>

2N/A

2N/A <section xml:id="global-configuration">

2N/A <title>Global Configuration</title>

2N/A <indexterm>

2N/A <primary>Configuration</primary>

2N/A <secondary>Global</secondary>

2N/A </indexterm>

2N/A

2N/A <para>Under Configuration &gt; Global you can set defaults for a range of

2N/A federation services, for password reset, for policy configuration, for

2N/A session management, and for dynamic user attributes.</para>

2N/A

2N/A <variablelist xml:id="common-federation-configuration">

2N/A <title>Common Federation Configuration</title>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>sunFAMFederationCommon</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Datastore SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to access user profile

2N/A attributes</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>DatastoreClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>ConfigurationInstance SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to access service configuration</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>ConfigurationClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Logger SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to record log messages</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>LoggerClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SessionProvider SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to access the session service</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>SessionProviderClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Maximum allowed content length</term>

2N/A <listitem>

2N/A <para>Maximum number of bytes for Federation communications</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>MaxContentLength</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>PasswordDecoder SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to decode passwords encoded by

2N/A OpenAM</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>PasswordDecoderClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SignatureProvider SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system digitally to sign SAML documents</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>SignatureProviderClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>KeyProvider SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to access the Java key store</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>KeyProviderClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Check presence of certificates</term>

2N/A <listitem>

2N/A <para>If enabled, OpenAM checks that the partner's signing certificate

2N/A presented in the XML matches the certificate from the partner's

2N/A metadata</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>CheckCert</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>XML canonicalization algorithm</term>

2N/A <listitem>

2N/A <para>Algorithm used to render the canonical versions of XML

2N/A documents</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>CannonicalizationAlgorithm</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>XML signature algorithm</term>

2N/A <listitem>

2N/A <para>Algorithm used to sign XML documents</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>SignatureAlgorithm</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>XML transformation algorithm</term>

2N/A <listitem>

2N/A <para>Algorithm used for XML transformations</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>TransformationAlgorithm</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SAML Error Page URL</term>

2N/A <listitem>

2N/A <para>OpenAM redirects users here when an error occurs in the SAML2

2N/A engine. Users are redirected to absolute URLs, whereas releative URLs

2N/A are displayed within the request.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>SAMLErrorPageURL</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>SAML Error Page HTTP Binding</term>

2N/A <listitem>

2N/A <para>Set this either to <literal>HTTP-Redirect</literal> or to

2N/A <literal>HTTP-POST</literal>.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>SAMLErrorPageHTTPBinding</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring Agent Provider Class</term>

2N/A <listitem>

2N/A <para>Used by the Federation system to access the monitoring system</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>MonAgentClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring Provider Class for SAML1</term>

2N/A <listitem>

2N/A <para>Used by the SAMLv1 engine to access the monitoring system</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>MonSAML1Class</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring Provider Class for SAML2</term>

2N/A <listitem>

2N/A <para>Used by the SAML2 engine to access the monitoring system</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>MonSAML2Class</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Monitoring Provider Class for ID-FF</term>

2N/A <listitem>

2N/A <para>Used by the ID-FF engine to access the monitoring system</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>MonIDFFClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="dashboard-configuration">

2N/A <title>Dashboard Configuration</title>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>dashboardService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Dashboard Class Name</term>

2N/A <listitem>

2N/A <para>Identifies how to access the application, for example

2N/A <literal>SAML2ApplicationClass</literal> for a SAML 2.0 application</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>dashboardClassName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Dashboard Name</term>

2N/A <listitem>

2N/A <para>The application name as it will appear to the administrator for

2N/A configuring the dashboard</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>dashboardName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A

2N/A <varlistentry>

2N/A <term>Dashboard Display Name</term>

2N/A <listitem>

2N/A <para>The application name that displays on the dashboard client</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>dashboardDisplayName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Dashboard Icon</term>

2N/A <listitem>

2N/A <para>The icon name that will be displayed on the dashboard client

2N/A identifying the application</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>dashboardIcon</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Dashboard Login</term>

2N/A <listitem>

2N/A <para>The URL that takes the user to the application</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>dashboardLogin</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Available Dashboard Apps</term>

2N/A <listitem>

2N/A <para>List of application dashboard names available by default for

2N/A realms with the Dashboard configured</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>assignedDashboard</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="email-service-configuration">

2N/A <title>Email Service</title>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>ForgeRockSendEmailService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Email Message Implementation Class</term>

2N/A <listitem>

2N/A <para>Specifies the class that sends email notifications, such as those

2N/A sent for user registration and forgotten passwords.</para>

2N/A

2N/A <para>Default: <literal>org.forgerock.openam.services.email.MailServerImpl</literal></para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockMailServerImplClassName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Mail Server Host Name</term>

2N/A <listitem>

2N/A <para>Specifies the fully qualified domain name of the SMTP mail server

2N/A through which to send email notifications.</para>

2N/A

2N/A <para>Default: <literal>smtp.gmail.com</literal></para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPHostName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Mail Server Host Port</term>

2N/A <listitem>

2N/A <para>Specifies the port number for the SMTP mail server.</para>

2N/A

2N/A <para>Default: 465</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPHostPort</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Mail Server Authentication Username</term>

2N/A <listitem>

2N/A <para>Specifies the user name for the SMTP mail server.</para>

2N/A

2N/A <para>Default: <literal>forgerocksmtp</literal></para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPUserName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Mail Server Authentication Password</term>

2N/A <listitem>

2N/A <para>Specifies the password for the SMTP user name.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPUserPassword</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Mail Server Secure Connection</term>

2N/A <listitem>

2N/A <para>Specifies whether to connect to the SMTP mail server using SSL.</para>

2N/A

2N/A <para>Default: use SSL (<literal>true</literal>)</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPSSLEnabled</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Email From Address</term>

2N/A <listitem>

2N/A <para>Specifies the address from which to send email notifications.</para>

2N/A

2N/A <para>Default: <literal>no-reply@openam.org</literal></para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPFromAddress</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Email Attribute Name</term>

2N/A <listitem>

2N/A <para>Specifies the profile attribute from which to retrieve the end user's

2N/A email address.</para>

2N/A

2N/A <para>Default: <literal>mail</literal></para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>openamEmailAttribute</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Email Subject</term>

2N/A <listitem>

2N/A <para>Specifies a subject for notification messages. If you do not set this

2N/A OpenAM does not set the subject for notification messages.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPSubject</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Email Content</term>

2N/A <listitem>

2N/A <para>Specifies content for notification messages. If you do not set this

2N/A OpenAM includes only the confirmation URL in the mail body.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>forgerockEmailServiceSMTPMessage</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="liberty-id-ff-service-configuration">

2N/A <title>Liberty ID-FF Service Configuration</title>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>sunFAMIDFFConfiguration</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>Federation Cookie Name</term>

2N/A <listitem>

2N/A <para>Cookie name for Liberty ID-FF</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>FedCookieName</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>IDP Proxy Finder SPI implementation class</term>

2N/A <listitem>

2N/A <para>Used by the ID-FF engine to find the IDP proxy</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>IDPProxyFinderClass</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Request cache cleanup interval</term>

2N/A <listitem>

2N/A <para>Seconds between times OpenAM cleans up the request cache</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>RequestCacheCleanupInterval</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>Request cache timeout</term>

2N/A <listitem>

2N/A <para>Seconds cached requests remain valid</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>RequestCacheTimeout</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>IDP Login URL</term>

2N/A <listitem>

2N/A <para>Login URL for the ID-FF IDP</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>IDPLoginURL</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>XML signing on</term>

2N/A <listitem>

2N/A <para>If yes, require XML signing.</para>

2N/A

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>XMLSigningOn</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A </variablelist>

2N/A

2N/A <variablelist xml:id="liberty-interaction-service-configuration">

2N/A <title>Liberty Interaction Service</title>

2N/A

2N/A <para><command>ssoadm</command> service name:

2N/A <literal>sunFAMLibertyInteractionService</literal></para>

2N/A

2N/A <varlistentry>

2N/A <term>WSP to redirect user for interaction</term>

2N/A <listitem>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>WSPWillRedirect</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>WSP to redirect user for interaction for data</term>

2N/A <listitem>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>WSPWillRedirectForData</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>WSP's expected duration for interaction</term>

2N/A <listitem>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>WSPRedirectTime</literal></para>

2N/A </listitem>

2N/A </varlistentry>

2N/A

2N/A <varlistentry>

2N/A <term>WSP to enforce that returnToURL must be SSL</term>

2N/A <listitem>

2N/A <para><command>ssoadm</command> attribute:

2N/A <literal>WSPWillEnforceHttpsCheck</literal></para>