Skip to content

Commit

Permalink
Update documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
maximthomas committed Feb 3, 2025
1 parent 7b5d1f2 commit d550260
Show file tree
Hide file tree
Showing 7 changed files with 11 additions and 11 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ Policy agents can have local configurations where they are installed. Typically,
[#gateway-or-policy-agent]
=== OpenIG or Policy Agent?
OpenAM supports both link:http://openig.forgerock.org/[OpenIG, window=\_blank] and also a variety of policy agents. OpenIG and the policy agents can both enforce policy, redirecting users to authenticate when necessary, and controlling access to protected resources. OpenIG runs as a self-contained reverse proxy located between the users and the protected applications. Policy agents are installed into the servers where applications run, intercepting requests in that context.
OpenAM supports both link:https://github.com/OpenIdentityPlatform/OpenIG[OpenIG, window=\_blank] and also a variety of policy agents. OpenIG and the policy agents can both enforce policy, redirecting users to authenticate when necessary, and controlling access to protected resources. OpenIG runs as a self-contained reverse proxy located between the users and the protected applications. Policy agents are installed into the servers where applications run, intercepting requests in that context.
Use OpenIG to protect access to applications not suited for a policy agent. Not all web servers and Java EE applications have policy agents. Not all operating systems work with policy agents.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -593,7 +593,7 @@ Letting users choose not to provide a verification token while authenticating ca
+
+
Users authenticating to the chain can authenticate successfully __without__ providing tokens from their devices. The reason for successful authentication in this case is that the `required` setting relates to the execution of the Authenticator (OATH) module itself. Internally, the ForgeRock Authenticator (OATH) module has the ability to forego processing a token while still returning a passing status to the authentication chain.
Users authenticating to the chain can authenticate successfully __without__ providing tokens from their devices. The reason for successful authentication in this case is that the `required` setting relates to the execution of the Authenticator (OATH) module itself. Internally, the Authenticator (OATH) module has the ability to forego processing a token while still returning a passing status to the authentication chain.
+
`ssoadm` attribute: `forgerockTwoFactorAuthMandatory`
Expand Down Expand Up @@ -1544,7 +1544,7 @@ The Device ID (Match) module comes pre-configured with default client-side and s
====
The Device ID (Match) module's default JavaScript client-side and server-side scripts are fully functional. If you change the client-side script, you must also make a corresponding change to the server-side script. For a safer option, if you want to change the behavior of the module, you can make a copy of the scripts, customize the behavior, and update the Device ID (Match) modules to use the new scripts.
====
The Device ID (Match) does not stand on its own within an authentication chain and requires additional modules. For example, you can have any module that identifies the user (for example, DataStore, Active Directory or others), Device ID (Match), any module that provides two-factor authentication, for example the ForgeRock Authenticator (OATH) or ForgeRock Authenticator (Push) authentication modules, and Device ID (Save) within your authentication chain.
The Device ID (Match) does not stand on its own within an authentication chain and requires additional modules. For example, you can have any module that identifies the user (for example, DataStore, Active Directory or others), Device ID (Match), any module that provides two-factor authentication, for example the Authenticator (OATH) or ForgeRock Authenticator (Push) authentication modules, and Device ID (Save) within your authentication chain.
As an example, you can configure the following modules with the specified criteria:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ link:http://en.wikipedia.org/wiki/Representational_state_transfer[Representation
As an architectural style, REST has very broad applications. The designs of both HTTP 1.1 and URIs follow RESTful principles. The World Wide Web is no doubt the largest and best known REST application. Many other web services also follow the REST architectural style. Examples include OAuth 2.0, OpenID Connect 1.0, and User-Managed Access (UMA) 1.0.
ForgeRock Common REST (CREST) applies RESTful principles to define common verbs for HTTP-based APIs that access web resources and collections of web resources.
Open Identity Platform Common REST (CREST) applies RESTful principles to define common verbs for HTTP-based APIs that access web resources and collections of web resources.
Native OpenAM REST APIs in version 11.0.0 and later use the CREST verbs. (In contrast, OAuth 2.0, OpenID Connect 1.0 and UMA 1.0 APIs follow their respective standards.) APIs covered in link:../dev-guide/index.html#appendix-deprecated-apis[Deprecated REST APIs] predate CREST, do not use the CREST verbs, and are deprecated in OpenAM 13.5.2-15.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
information: "Portions copyright [year] [name of copyright owner]".

Copyright 2017 ForgeRock AS.
Portions Copyright 2024 3A Systems LLC.
Portions Copyright 2024-2025 3A Systems LLC.
////
:figure-caption!:
Expand Down Expand Up @@ -1347,7 +1347,7 @@ OpenAM examples often use Apache Tomcat (Tomcat) as the deployment container. To
OpenAM core services require a minimum JVM heap size of 1 GB, and a permanent generation size of 256 MB. If you are including the embedded OpenDJ directory, OpenAM requires at least a 2 GB heap, as 50% of that space is allocated to OpenDJ. See xref:#prepare-java["Preparing a Java Environment"] for details.
ForgeRock recommends that you edit the Tomcat <Connector> configuration to set `URIEncoding="UTF-8"`. UTF-8 URI encoding ensures that URL-encoded characters in the paths of URIs are correctly decoded by the container. This is particularly useful when applications use the OpenAM REST APIs, and some identifiers, such as user names can contain special characters.
Open Identity Platform Community recommends that you edit the Tomcat <Connector> configuration to set `URIEncoding="UTF-8"`. UTF-8 URI encoding ensures that URL-encoded characters in the paths of URIs are correctly decoded by the container. This is particularly useful when applications use the OpenAM REST APIs, and some identifiers, such as user names can contain special characters.
You should also ensure `sslProtocol` is set to `TLS`, which disables the potentially vulnerable SSL v3.0 protocol.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1949,7 +1949,7 @@ Specifies content for notification messages. If you do not set this OpenAM inclu
`ssoadm` service name: `AuthenticatorOATH`
Profile Storage Attribute::
Attribute for storing ForgeRock Authenticator OATH profiles. The default attribute, `oathDeviceProfiles`, is added to the user store during OpenAM installation. If you want to use a different attribute, you must make sure to add it to your user store schema prior to deploying two-step verification with a ForgeRock OATH authenticator app in OpenAM. OpenAM must be able to write to the attribute.
Attribute for storing Authenticator OATH profiles. The default attribute, `oathDeviceProfiles`, is added to the user store during OpenAM installation. If you want to use a different attribute, you must make sure to add it to your user store schema prior to deploying two-step verification with a ForgeRock OATH authenticator app in OpenAM. OpenAM must be able to write to the attribute.
+
Default: `oathDeviceProfiles`
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
information: "Portions copyright [year] [name of copyright owner]".

Copyright 2017 ForgeRock AS.
Portions Copyright 2024 3A Systems LLC.
Portions Copyright 2024-2025 3A Systems LLC.
////
:figure-caption!:
Expand Down Expand Up @@ -735,7 +735,7 @@ Enter the full path to the file containing the agent profile password.
To have the installer change the ownership of created directories to be the same User and Group as specified in the Apache configuration, specify the optional `--changeOwner` switch.
`--acceptLicence`::
You can suppress the license agreement prompt during a silent, non-interactive install by including the `--acceptLicence` parameter. The inclusion of the option indicates that you have read and accepted the terms stated in the license. To view the license agreement, open `/path/to/web_agents/agent_type/legal/Forgerock_License.txt`.
You can suppress the license agreement prompt during a silent, non-interactive install by including the `--acceptLicence` parameter. The inclusion of the option indicates that you have read and accepted the terms stated in the license. To view the license agreement, open `/path/to/web_agents/agent_type/legal/CDDLv1.0.txt`.
`--forceInstall`::
Optionally have the installer proceed with a silent installation even if it cannot connect to the specified OpenAM server during installation, rather than exiting.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
information: "Portions copyright [year] [name of copyright owner]".

Copyright 2017 ForgeRock AS.
Portions Copyright 2024 3A Systems LLC.
Portions Copyright 2024-2025 3A Systems LLC.
////
:figure-caption!:
Expand Down Expand Up @@ -102,7 +102,7 @@ Use this option to change the ownership of the created directories to be the sam
When you run certain commands, you will be prompted to read and accept the software license agreement. You can suppress the license agreement prompt by including the optional `--acceptLicence` parameter. Specifying this options indicates that you have read and accepted the terms stated in the license.
+
To view the license agreement, open `/path/to/web_agents/agent_type/legal/Forgerock_License.txt`.
To view the license agreement, open `/path/to/web_agents/agent_type/legal/CDDLv1.0.txt`.
`--forceInstall`::
Add this option to proceed with a silent installation even if it cannot connect to the specified OpenAM server during installation, rather than exiting.
Expand Down

0 comments on commit d550260

Please sign in to comment.