# OpenAM Administration Guide
Chapter 20. Securing OpenAM

Sidebar | Prev | Up | Next

## 20.1. Avoiding Obvious Defaults

OpenAM includes default settings to make it easier for you to evaluate the software. Avoid these default settings in production deployments.

- When connecting to LDAP, bind with a specific administrative account rather than a root DN account if possible.

- Change the default `iPlanetDirectoryPro` cookie name both in OpenAM (`com.iplanet.am.cookie.name`) and in your policy agent profiles (`com.sun.identity.agents.config.cookie.name`).

- When installing OpenAM, do not use `/openam` or `/opensso` as the deployment URI.

- Set valid goto URL domains for OpenAM in the core authentication module configuration. The parameter is described in the section providing Hints For the Core Authentication Module (`iplanet-am-auth-valid-goto-domains`).

- Create an administrator in the top-level realm with a different ID than the default `amadmin`.

- Create specific administrator users to track better who makes configuration changes.

- Set the OpenAM advanced property `openam.auth.soap.rest.generic.authentication.exception` to `true`. This causes OpenAM to return the same exception both when the user does not exist, and also when the password is not valid.