#

# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.

#

# Copyright 2012-2015 ForgeRock AS.

#

# The contents of this file are subject to the terms

# of the Common Development and Distribution License

# (the License). You may not use this file except in

# compliance with the License.

#

# You can obtain a copy of the License at

# http://forgerock.org/license/CDDLv1.0.html

# See the License for the specific language governing

# permission and limitations under the License.

#

# When distributing Covered Code, include this CDDL

# Header Notice in each file and include the License file

# at http://forgerock.org/license/CDDLv1.0.html

# If applicable, add the following below the CDDL Header,

# with the fields enclosed by brackets [] replaced by

# your own identifying information:

# "Portions copyright [year] [name of copyright owner]"

#

#

# Portions Copyrighted 2014-2015 Nomura Research Institute, Ltd.

#

forgerock-oauth2-provider-description=OAuth2 Provider

# Global settings

g101=OpenID Connect Claims extension Script Timeout

g101.help=The maximum execution time any individual script should take on the server (in seconds).

g101.help.txt=Scripts will be forcibly stopped after this amount of execution time.

g102=Core thread pool size

g102.help=The core size of the thread pool from which scripts will operate.

g103=Maximum thread pool size

g103.help=The maximum size of the thread pool from which scripts will operate.

g103.help.txt=New threads will be created up to this size once the task queue reaches capacity. Has no effect if the \

queue is unbounded.

g104=Thread pool queue size

g104.help=Size of queue to use for buffering script execution request when core pool is at capacity.

g104.help.txt=Use -1 for an unbounded queue (this disables the maximum pool size setting). For short, CPU-bound \

scripts, consider a small pool size and larger queue length. For I/O-bound scripts (e.g., REST calls) consider \

a larger maximum pool size and a smaller queue. Not hot-swappable: restart server for changes to take effect.

g105=Thread idle timeout (seconds)

g105.help=Length of time (in seconds) to wait before terminating threads.

g105.help.txt=Length of time (in seconds) to wait before terminating threads that were started when the queue reached \

capacity. Only applies to threads beyond the core pool size (up to the maximum size).

g106=Java class whitelist

g106.help=List of patterns of allowed Java classes that may be loaded/accessed by scripts.

g106.help.txt=Each Java class accessed by a script must match at least one of these patterns. Use '*' as a wildcard, \

e.g. <code>java.lang.*</code>

g107=Java class blacklist

g107.help=List of patterns of Java classes that must not be accessed by a script.

g107.help.txt=This blacklist is applied after the whitelist to apply additional restrictions. For instance you may \

whitelist java.lang.* and then blacklist java.lang.System and java.lang.Runtime. It is recommended to always prefer \

specific whitelists where possible.

g108=Use system SecurityManager

g108.help=Indicates whether the system SecurityManager should also be consulted when checking access to Java classes.

g108.help.txt=If enabled, then the checkPackageAccess method will be called for each Java class accessed. If no \

SecurityManager is configured, then this has no effect.

a100=Authorization Code Lifetime (seconds)

a100.help=The time in seconds an authorization code is valid for

a101=Refresh Token Lifetime (seconds) If this field is set to -1, the token \

will never expire.

a101.help=The time in seconds a refresh token is valid for

a102=Access Token Lifetime (seconds)

a102.help=The time in seconds an access token is valid for

a103=Issue Refresh Tokens

a103.help=Check to enable generation of refresh tokens

a103a=Issue Refresh Tokens on Refreshing Access Tokens

a103a.help=Check to enable generation of refresh tokens when refreshing access tokens

a103b=Custom Login URL Template

a103b.help=A Freemarker template which will create a custom URL for the login page to authenticate the resource owner. \

The following values are available to the Freemarker template: gotoUrl - the URL to redirect back to the OAuth2 \

authorization process, acrValues - the acr values for the OAuth2 authorization request, realm - the OpenAM realm \

the OAuth2 authorization request was made on, module - the name of the OpenAM authentication module requested to \

perform resource owner authentication, service - the name of the OpenAM authentication chain requested to perform \

resource owner authentication, locale - a space separated list of locales ordered by preference.

a104=Scope Implementation Class

a104.help=The class that contains the required scope implementation

a104aa=OIDC Claims Script.

a104aa.help=This is a script that will be run, when using an implementation of the \

org.forgerock.openam.oauth2.OpenAMScopeValidator, when issuing an ID Token or making a request to the userinfo \

endpoint that will gather and fill in all claims for the request. The script has access to the requested scopes, \

the access token, the user's session (if available), the user's identity.

a104ab=OIDC Claims Script Type.

a104ab.help=This is the language of the OIDC claims script

scriptGroovyChoice=Groovy

scriptJavaScriptChoice=JavaScript

a105=Response Type Plugins

a105.help=Response types are input as such, code|name of plugin class. For example, code|org.forgerock.openam.oauth2.CodeClass. \

If there is no implementation class none should be used in place of the class name. For example id_token|none.

a106=User Profile Attribute(s) the Resource Owner is Authenticated On

a106.help=If the attribute is mail and uid, then a search string of (|(mail=user)(uid=user)) will be used to get the \

user profile, where user is the username entered during authentication.

a107=Saved Consent Attribute Name

a107.help=To use saved consent a list attribute must be set up and the attribute name provided.

a108=Supported Scopes

a108.help=A list of scopes this authorization server supports, with translations.

a108.help.txt=Scopes may be entered as simple strings or pipe separated strings representing the internal scope name, \

locale, and localized description; e.g. "read|en|Permission to view email messages in your account". Locale strings \

are in the format <code>language + "_" + country + "_" + variant</code>, e.g. en, en_GB, en_US_WIN. \

If the locale and pipe is omitted, the description is displayed to all users having undefined locales. \

e.g. "read|Permission to view email messages in your account". \

<i>NB</i> If the description is also omitted, nothing is displayed to all users, e.g. specifying "read|" would allow \

the scope "read" to be used by the client, but would not display it to the user when it was requested.

a109=Remote JSON Web Key URL

a109.help=The Remote URL where the providers JSON Web Key can be retrieved.

a110=Subject Types supported

a110.help=List of subject types supported. Valid values are pairwise and public.

a111=ID Token Signing Algorithms supported

a111.help=Algorithms supported to sign id_tokens.

a112=Supported Claims

a112.help=List of claims supported by the userinfo endpoint, with translations.

a112.help.txt=Claims may be entered as simple strings or pipe separated strings representing the internal claim name, \

locale, and localized description; e.g. "read|en|Permission to view email messages in your account". Locale strings \

are in the format <code>language + "_" + country + "_" + variant</code>, e.g. en, en_GB, en_US_WIN. \

If the locale and pipe is omitted, the description is displayed to all users having undefined locales. \

e.g. "name|Your full name". \

<i>NB</i> If the description is also omitted, nothing is displayed to all users, e.g. specifying "name|" would allow \

the claim "name" to be used by the client, but would not display it to the user when it was requested.

a113=OpenID Connect JWT Token Lifetime (seconds)

a113.help=The amount of time in seconds the JWT will be valid for.

a114=Alias of ID Token Signing Key

a114.help=The name of the key put in the keystore used to sign the ID Tokens issued by OpenAM.

a115=Allow Open Dynamic Client Registration

a115.help=Allow clients to register without an access token. If enabled, you should consider adding some form of rate \

limiting. See <a href="http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration" \

target="_blank">Client Registration</a> in the OpenID Connect specification for details.

a116=Generate Registration Access Tokens

a116.help=Whether to generate Registration Access Tokens for clients that register via open dynamic client \

registration. Such tokens allow the client to access the <a \

href="http://openid.net/specs/openid-connect-registration-1_0.html#ClientConfigurationEndpoint" \

target="_blank">Client Configuration Endpoint</a> as per the OpenID Connect specification. This setting has \

no effect if open dynamic client registration is disabled.

a117=OpenID Connect acr_values to Auth Chain Mapping

a117.help=Maps OpenID Connect ACR values to authentication chains. See <a \

href="http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" target="_blank">the acr_values parameter</a> \

in the OpenID Connect authentication request specification for more details.

a118=OpenID Connect default acr claim

a118.help=Default value to use as the 'acr' claim in an OpenID Connect ID Token when using the default authentication \

chain.

a119=OpenID Connect id_token amr values to Auth Module mappings

a119.help=If you require <code>amr</code> values to be returned in the OpenID Connect <code>id_token</code>, you can \

configure them here. Once authentication has completed, the authentication modules that were used from the \

authentication service will be mapped to the <code>amr</code> values. If you do not require amr values, or are not \

providing OpenID Connect tokens at all, this field can be left blank.

a120=Modified Timestamp attribute name

a120.help=The attribute name of the modified timestamp in the identity repository (must also be added to the User \

Attributes List on the Datastore Service page).

a121=Created Timestamp attribute name

a121.help=The attribute name of the created timestamp in the identity repository (must also be added to the User \

Attributes List on the Datastore Service page).

a122=Default Client Scopes

a122.help=List of scopes a client will be granted if they request registration without specifying which scopes they \

want. Default scopes are NOT auto-granted to clients created through the administrator interface.

a123=Enable "claims_parameter_supported"

a123.help=If enabled, clients will be able to request individual claims using the "claims" Request Parameter \

as per section 5.5 of the OpenID Connect specification.

a124=Subject identifier hash salt

a124.help=If pairwise subject types are supported, it is STRONGLY RECOMMENDED to set this value. It is used in \

the salting of hashes for returning specific sub claims to individuals using the same request_uri or \

sector_identifier_uri.

a125=Always return claims in ID Tokens

a125.help=All id_tokens will contain scope-derived claims. Warning: not strictly spec-compliant.

a125.help.txt=The <a href="http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims">OpenID Connect \

specification</a> is ambiguous whether scope-derived claims should always be added to the ID Token. This is \

disabled by default in order to guarantee compliance, but can be enabled for situations where calling the \

userinfo endpoint is not practical, but an access token is still wanted.

a126=Code verifier parameter required

a126.help=If enabled, Authorization Code requests will require a "code_challenge" attribute

a126.help.txt=The spec for this feature can be found <a href="https://tools.ietf\

.org/html/draft-ietf-oauth-spop-12">here</a>

a1075=User Display Name attribute

a1075.help=The attribute for identities retrieved from the ID Repository that contains a displayable name for the user \

for use in the consent page.