What is the Core Token Service (CTS) in ForgeRock AM and what does it store?

The Core Token Service (CTS) is the central token storage layer in ForgeRock AM. It is a key-value store backed by ForgeRock Directory Services (DS) that persists all transient token and session state that AM needs to maintain across cluster nodes. Without a shared CTS store, an AM cluster cannot provide seamless failover — if a user's session was pinned to a node that restarts, they would be forced to re-authenticate.

CTS stores several categories of objects, each with a configurable time-to-live:

• AM SSO Sessions — The stateful session records for authenticated users. Contains session properties, idle timeout, max timeout, and the authentication level.
• OAuth2 / OIDC Tokens — Access tokens, refresh tokens, and authorization codes when opaque (non-JWT) tokens are used. JWT access tokens validated locally do not need CTS storage.
• SAML2 Assertions and Sessions — SP session indexes and IdP session data needed for Single Logout.
• Device Fingerprints and Push Notifications — State for multi-step authentication flows such as push approval challenges.
• UMA Tokens — Requesting Party Tokens (RPTs) and Permission Tickets for User Managed Access flows.

The DS instance backing CTS is performance-critical. It is typically deployed in a dedicated DS topology separate from the user identity store — the two have very different access patterns. CTS sees high write throughput (new sessions and token rotations) and needs low-latency reads, so it benefits from SSD storage and a sufficient memory cache. In AM 7.x, token compression and optional Hazelcast-based in-memory caching were introduced to reduce DS read load for high-volume deployments.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.