1211N/A#

1211N/A# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.

1211N/A#

1211N/A# Copyright 2012-2015 ForgeRock AS.

1211N/A#

1211N/A# The contents of this file are subject to the terms

1211N/A# of the Common Development and Distribution License

1211N/A# (the License). You may not use this file except in

1211N/A# compliance with the License.

1211N/A#

1211N/A# You can obtain a copy of the License at

1211N/A# http://forgerock.org/license/CDDLv1.0.html

1211N/A# See the License for the specific language governing

1211N/A# permission and limitations under the License.

1211N/A#

1211N/A# When distributing Covered Code, include this CDDL

1211N/A# Header Notice in each file and include the License file

1211N/A# at http://forgerock.org/license/CDDLv1.0.html

1211N/A# If applicable, add the following below the CDDL Header,

1211N/A# with the fields enclosed by brackets [] replaced by

1211N/A# your own identifying information:

1211N/A# "Portions copyright [year] [name of copyright owner]"

1211N/A#

1211N/A

3231N/A#

5289N/A# Portions Copyrighted 2014-2015 Nomura Research Institute, Ltd.

1211N/A#

1211N/A

2086N/Aforgerock-oauth2-provider-description=OAuth2 Provider

1211N/A

1211N/A# Global settings

1211N/Ag101=OpenID Connect Claims extension Script Timeout

1224N/Ag101.help=The maximum execution time any individual script should take on the server (in seconds).

1224N/Ag101.help.txt=Scripts will be forcibly stopped after this amount of execution time.

1224N/Ag102=Core thread pool size

1211N/Ag102.help=The core size of the thread pool from which scripts will operate.

1211N/Ag103=Maximum thread pool size

1224N/Ag103.help=The maximum size of the thread pool from which scripts will operate.

1224N/Ag103.help.txt=New threads will be created up to this size once the task queue reaches capacity. Has no effect if the \

1211N/A queue is unbounded.

1211N/Ag104=Thread pool queue size

1224N/Ag104.help=Size of queue to use for buffering script execution request when core pool is at capacity.

4134N/Ag104.help.txt=Use -1 for an unbounded queue (this disables the maximum pool size setting). For short, CPU-bound \

1211N/A scripts, consider a small pool size and larger queue length. For I/O-bound scripts (e.g., REST calls) consider \

2086N/A a larger maximum pool size and a smaller queue. Not hot-swappable: restart server for changes to take effect.

1211N/Ag105=Thread idle timeout (seconds)

3538N/Ag105.help=Length of time (in seconds) to wait before terminating threads.

1211N/Ag105.help.txt=Length of time (in seconds) to wait before terminating threads that were started when the queue reached \

1211N/A capacity. Only applies to threads beyond the core pool size (up to the maximum size).

1211N/Ag106=Java class whitelist

1211N/Ag106.help=List of patterns of allowed Java classes that may be loaded/accessed by scripts.

1211N/Ag106.help.txt=Each Java class accessed by a script must match at least one of these patterns. Use '*' as a wildcard, \

1211N/A e.g. <code>java.lang.*</code>

1211N/Ag107=Java class blacklist

1211N/Ag107.help=List of patterns of Java classes that must not be accessed by a script.

1211N/Ag107.help.txt=This blacklist is applied after the whitelist to apply additional restrictions. For instance you may \

1211N/A whitelist java.lang.* and then blacklist java.lang.System and java.lang.Runtime. It is recommended to always prefer \

1211N/A specific whitelists where possible.

1211N/Ag108=Use system SecurityManager

1211N/Ag108.help=Indicates whether the system SecurityManager should also be consulted when checking access to Java classes.

1211N/Ag108.help.txt=If enabled, then the checkPackageAccess method will be called for each Java class accessed. If no \

1211N/A SecurityManager is configured, then this has no effect.

1211N/A

1211N/Aa100=Authorization Code Lifetime (seconds)

1224N/Aa100.help=The time in seconds an authorization code is valid for

1224N/Aa101=Refresh Token Lifetime (seconds)

1211N/Aa101.help=The time in seconds a refresh token is valid for

1211N/Aa102=Access Token Lifetime (seconds)

1211N/Aa102.help=The time in seconds an access token is valid for

1211N/Aa103=Issue Refresh Tokens

1211N/Aa103.help=Check to enable generation of refresh tokens

1211N/Aa103a=Issue Refresh Tokens on Refreshing Access Tokens

1211N/Aa103a.help=Check to enable generation of refresh tokens when refreshing access tokens

1211N/Aa104=Scope Implementation Class

1211N/Aa104.help=The class that contains the required scope implementation

1224N/Aa104aa=OIDC Claims Script.

1224N/Aa104aa.help=This is a script that will be run, when using an implementation of the \

1211N/A org.forgerock.openam.oauth2.OpenAMScopeValidator, when issuing an ID Token or making a request to the userinfo \

1211N/A endpoint that will gather and fill in all claims for the request. The script has access to the requested scopes, \

1211N/A the access token, the user's session (if available), the user's identity.

1211N/Aa104ab=OIDC Claims Script Type.

1211N/Aa104ab.help=This is the language of the OIDC claims script

1211N/AscriptGroovyChoice=Groovy

1211N/AscriptJavaScriptChoice=JavaScript

1211N/Aa105=Response Type Plugins

1211N/Aa105.help=Response types are input as such, code|name of plugin class. For example, code|org.forgerock.openam.oauth2.CodeClass. \

1211N/AIf there is no implementation class none should be used in place of the class name. For example id_token|none.

1211N/Aa106=User Profile Attribute(s) the Resource Owner is Authenticated On

1211N/Aa106.help=If the attribute is mail and uid, then a search string of (|(mail=user)(uid=user)) will be used to get the \

1211N/Auser profile, where user is the username entered during authentication.

1211N/Aa107=Saved Consent Attribute Name

1211N/Aa107.help=To use saved consent a list attribute must be set up and the attribute name provided.

1211N/Aa108=Supported Scopes

1211N/Aa108.help=A list of scopes this authorization server supports.

3538N/Aa109=Remote JSON Web Key URL

1211N/Aa109.help=The Remote URL where the providers JSON Web Key can be retrieved.

1211N/Aa110=Subject Types supported

1211N/Aa110.help=List of subject types supported. Values are pairwise and public. Pairwise is the same as confidential.

1211N/Aa111=ID Token Signing Algorithms supported

1211N/Aa111.help=Algorithms supported to sign id_tokens.

1211N/Aa112=Supported Claims

1211N/Aa112.help=List of claims supported by the userinfo endpoint.

1211N/Aa113=OpenID Connect JWT Token Lifetime (seconds)

1211N/Aa113.help=The amount of time in seconds the JWT will be valid for.

1211N/Aa114=Alias of ID Token Signing Key

1211N/Aa114.help=The name of the key put in the keystore used to sign the ID Tokens issued by OpenAM.

2086N/Aa115=Allow Open Dynamic Client Registration

2086N/Aa115.help=Allow clients to register without an access token. If enabled, you should consider adding some form of rate \

1211N/A limiting. See <a href="http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration" \

2086N/A target="_blank">Client Registration</a> in the OpenID Connect specification for details.

1211N/Aa116=Generate Registration Access Tokens

1211N/Aa116.help=Whether to generate Registration Access Tokens for clients that register via open dynamic client \

1211N/A registration. Such tokens allow the client to access the <a \

1224N/A href="http://openid.net/specs/openid-connect-registration-1_0.html#ClientConfigurationEndpoint" \

1224N/A target="_blank">Client Configuration Endpoint</a> as per the OpenID Connect specification. This setting has \

1224N/A no effect if open dynamic client registration is disabled.

1224N/Aa117=OpenID Connect acr_values to Auth Chain Mapping

1224N/Aa117.help=Maps OpenID Connect ACR values to authentication chains. See <a \

1224N/A href="http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" target="_blank">the acr_values parameter</a> \

1211N/A in the OpenID Connect authentication request specification for more details.

1224N/Aa118=OpenID Connect default acr claim

1224N/Aa118.help=Default value to use as the 'acr' claim in an OpenID Connect ID Token when using the default authentication \

1224N/A chain.

1224N/Aa119=OpenID Connect id_token amr values to Auth Module mappings

1224N/Aa119.help=If you require <code>amr</code> values to be returned in the OpenID Connect <code>id_token</code>, you can \

1224N/A configure them here. Once authentication has completed, the authentication modules that were used from the \

1756N/A authentication service will be mapped to the <code>amr</code> values. If you do not require amr values, or are not \

1224N/A providing OpenID Connect tokens at all, this field can be left blank.

1756N/Aa120=Modified Timestamp attribute name

1756N/Aa120.help=The attribute name of the modified timestamp in the identity repository (must also be added to the User \

1224N/A Attributes List on the Datastore Service page).

1224N/Aa121=Created Timestamp attribute name

1224N/Aa121.help=The attribute name of the created timestamp in the identity repository (must also be added to the User \

1224N/A Attributes List on the Datastore Service page).

2086N/Aa122=Default Client Scopes

1224N/Aa122.help=List of scopes a client will be granted if they request registration without specifying which scopes they \

2086N/A want. Default scopes are NOT auto-granted to clients created through the administrator interface.