OpenAM 13.5 Core Token Service

– – – OPENAM 13.5 – CTS  by Olivier Rivat – Janua’s CTO

1.   Agenda ● CTS Presensation ● CTS architectural presentation ● CTS setup ● Managing CTS tokens ● CTS monitoring ● pointers
2.   CTS : Core Token Service ● CTS Overview – provides persistent and highly available token storage – dedicated to store OAuth 2.0, SAML v2.0, and UMA tokens ● Requirements – OpenDJ only, not compatible with any other ldap ● Recommendation – Configure external CTS for high Volume
3.   Architectural Considerations (1) ● 2 configuration models available – Active/passive ● OpenAM’s connection to the CTS token store is limited to a single master instance with failover instances – Affinity ● CTS token have an affinity for a given directory server instance ● OpenAM connects to one or more writable directory server instances. Each instance acts as the master for a subset of CTS tokens ●
4.  Architectural Considerations (2) ● Load Balancer – Do not put a load balancer in front of the CTS Stores ● Example :
5. . Steps to configure CTS ● Architectural configuration – Choose configuration deployment : Active/passive or affinity ● OpenDJ – Install and configure opendj in a replicated topology ● CTS setup – Prepare the OpenDJ Directory Service for CTS – Import CTS Files – Non-Admin User Creation and ACI Import – CTS Index Import and Build – OpenAM CTS Configuration –
6.  Managing CTS Tokens ● CTS Token properties – encryption of CTS tokens – GZip-based compression of CTS tokens – minimum CTS token lifetime (token erased, if no activity) ● Tuning consideration – Default queue size (5000) – Default timeout activity (120s)
7.   CTS monitoring ● SNMP monitoring available – Dedicated cts mib avaialable : FORGEROCK-OPENAM-CTS.mib – Can be integrated within supervision tools
8.  Pointers ● OPENAM Documentation – CTS presentation: https://backstage.forgerock.com/docs/openam/13.5/install-guide/#chap-c ts – CTS monitoring https://backstage.forgerock.com/docs/openam/13.5/admin-guide/#snmp-p olicy-evaluation ● Knowledge base articles – FAQ: Core Token Service (CTS) and session high availability in OpenAM/AM https://backstage.forgerock.com/knowledge/kb/article/a23093000 – Best practice for configuring an external OpenDJ/DS instance for the Core Token Service (CTS) in OpenAM 12.x, 13.x and AM (All versions) https://backstage.forgerock.com/knowledge/kb/article/a46985800