# OpenAM Administration Guide
2.2.5. Hints For the Core Authentication Module

Sidebar | Prev | Up | Next

#### 2.2.5.7. Core - Post Authentication Processing

This section of the Core Authentication module specifies options for post authentication processing.

Default Success Login URL

  Accepts a list of values that specifies where users are directed after successful authentication. The format of this attribute is ``client-type`|`URL`` although the only value you can specify at this time is a URL which assumes the type HTML. The default value is `/openam/console`. Values that do not specify HTTP have that appended to the deployment URI.

  ssoadm attribute: `iplanet-am-auth-login-success-url`

Default Failure Login URL

  Accepts a list of values that specifies where users are directed after authentication has failed. The format of this attribute is ``client-type`|`URL`` although the only value you can specify at this time is a URL which assumes the type HTML. Values that do not specify HTTP have that appended to the deployment URI.

  ssoadm attribute: `iplanet-am-auth-login-failure-url`

Authentication Post Processing Classes

  Specifies one or more Java classes used to customize post authentication processes for successful or unsuccessful logins. The Java class must implement the `com.sun.identity.authentication.spi.AMPostAuthProcessInterface` OpenAM interface.

  A .jar containing the post processing class belongs in the `WEB-INF/lib` directory of the deployed OpenAM instance. If you do not build a .jar, add the class files under `WEB-INF/classes`. For deployment, add the .jar or classes into a custom OpenAM .war file.

  ssoadm attribute: `iplanet-am-auth-post-login-process-class`

Generate UserID Mode

  When enabled, the Membership module generates a list of alternate user identifiers if the one entered by a user during the self-registration process is not valid or already exists. The user identifiers are generated by the class specified in the Pluggable User Name Generator Class property.

  ssoadm attribute: `iplanet-am-auth-username-generator-enabled`

Pluggable User Name Generator Class

  Specifies the name of the class used to generate alternate user identifiers when Generate UserID Mode is enabled. The default value is `com.sun.identity.authentication.spi.DefaultUserIDGenerator`.

  ssoadm attribute: `iplanet-am-auth-username-generator-class`

User Attribute Mapping to Session Attribute

  Enables the authenticating user's identity attributes (stored in the identity repository) to be set as session properties in the user's SSOToken. The value takes the format ``User-Profile-Attribute`|`Session-Attribute-Name``. If `Session-Attribute-Name` is not specified, the value of `User-Profile-Attribute` is used. All session attributes contain the `am.protected` prefix to ensure that they cannot be edited by the Client SDK.

  For example, if you define the user profile attribute as mail and the user's email address (available in the user session) as `user.mail`, the entry for this attribute would be `mail|user.mail`. After a successful authentication, the `SSOToken.getProperty(String)` method is used to retrieve the user profile attribute set in the session. The user's email address is retrieved from the user's session using the `SSOToken.getProperty("am.protected.user.mail")` method call.

  Properties that are set in the user session using User Attribute Mapping to Session Attributes can not be modified (for example, `SSOToken.setProperty(String, String)`). This results in an `SSOException`. Multi-value attributes, such as `memberOf`, are listed as a single session variable with a `|` separator.

  ssoadm attribute: `sunAMUserAttributesSessionMapping`