OpenAM fixes a number of issues, and provides the following additional features. The Universal Gateway is a high-performance reverse proxy server with specialized session management and credential replay functionality. The Universal Gateway may run as a standalone simple single sign-on solution, or be integrated with an existing web access management system. With either method, there is no need to modify the target application or the container that it runs in. The universal fedlet includes federation capabilities in the gateway, enabling federation capabilities for applications that cannot be modified to use the Fedlet and SAML 2.0. OpenAM now handles Active Directory password expiration responses properly. Setup wizards make it easier to use OpenLDAP and OpenDJ as the identity repository. SAML 2.0 extensions let the system handle situations more flexibly. For example, the extensions let the system handle situations that arise when the identity provider receives failed an authentication request and so must skip some processing, or when there remains additional interaction with the user after a completed assertion but before providing authorization. A new, beta session failover mechanism introduces a replacement for the existing implementation that relies on Message Queue and Berkeley DB with a highly scalable, pure Java implementation. Improvements in the upgrade process streamline the move to the new version. OpenAM now supports YubiKey authentication. The YubiKey simplifies the process of logging in with a One Time Password token as it does not require the user to re-type long pass codes from a display device into the login field of the computer. The YubiKey is inserted in the USB-port of any computer and the OTP is generated and automatically entered with a simple touch of a button on the YubiKey, and without the need of any client software or drivers.