The name of the query parameter bearing the SSO ticket to be extracted.

sso

The ticket decoder plugin used to decode the SSO ticket.

Security note: If tickets are transported via the web browser (in the URL), they need to be protected. Make sure to use an appropriate ticket decoder securing the ticket (e.g. digitally signed and/or encrypted)!

AES256 Decryption Ticket Decoder Esp Sign Ticket Decoder JWT Ticket Decoder OAuth 2.0 Access Token Ticket Decoder Plain Base64 Ticket Decoder Plain Ticket Decoder RSA Sign Ticket Decoder

Configures the repository used to store accepted SSO tickets and reject previously accepted ones.

The in-memory repository cannot be used if multiple instances of IAM are deployed in parallel (failover, horizontal scaling). Furthermore, the in-memory repository does not preserve previously accepted SSO tickets across IAM restarts.

In-Memory Accepted SSO Tickets Repository Persistent Accepted SSO Tickets Repository

List of ticket context data extractors that extract custom data from the ticket.

SSO Ticket Context Data Extractor

The ticket key containing the username.

username

The ticket key containing the provided username, which is used for logging and possibly displayed.

This is not combinable with Username Transformation. If the ticket does not contain a provided username, the value from "Username Key" is used.

The ticket key containing the user's roles. If not configured, no roles are extracted from the ticket.

roles

If configured, the user is loaded from local persistence and checked for validity. Authentication fails if the user is not found or is invalid. If no user store is configured, no persistency look-up takes place and the authentication is performed on data contained within the credential only.

Active Directory Connector Custom User Persister-based User Store Provider Database User Store Extended User Persister-based User Store Provider LDAP Connector User Persister-based User Store

Transforms the provided username from the credential to a technical user ID.

Airlock 2FA Username Transformer Context Data Username Transformer Identity Username Transformer Lowercase Transformer Primary Key Lookup Regex Username Transformer Template-based Username Transformer Token Data Username Transformer Uppercase Transformer

Static list of roles granted to the authenticated user.

List of role names that won't be granted to the authenticated user. The block list is also applied to persistent roles (if available).