ForgeRock Access Management

Identity and Access Management (IAM) has evolved from basic user accounts and group-based access into a specialized set of technologies for authenticating, authorizing, auditing, and protecting identities. Modern IAM typically includes provisioning, identity repositories, authentication, authorization, web access management (WAM), federation and Single Sign-On (SSO), identity governance, access reconciliation, and risk management, with extensive integration points to other security systems. Many IAM capabilities are standardized or commoditized, pushing products to support key standards such as SCIM (provisioning), LDAP (identity storage), Kerberos/RADIUS/PKI/FIDO (authentication), SAML/OAuth/OpenID Connect (federation), and XACML/UMA (authorization and user-managed consent). UMA, a Kantara Initiative standard, is positioned as increasingly important for obtaining user consent and supporting GDPR-related requirements.

ForgeRock Access Management is ForgeRock’s WAM and SSO component within the broader ForgeRock Identity Platform, integrating with Common Services, Identity Management, Identity Gateway (for federation), Directory Services, and UMA through a shared administrative UI. It supports major federation protocols (SAML, OAuth2, OpenID Connect) and a wide range of authentication mechanisms, including directories, certificates, OTP, mobile and social logins, and third-party (including biometric) authenticators. It enables adaptive authentication and risk-based decisions using contextual signals (device, location, time, history), and can incorporate external risk inputs via an XACML-aligned architecture. Policies can be imported/exported as XACML and/or JSON, though XACML support includes “Advice” but not “Obligations.”

The product targets enterprise B2E, B2B, and B2C use cases at large scale, runs across common OS and application servers, and integrates with many SaaS apps via SAML/OAuth/OIDC. It offers both stateful high-availability deployments and a stateless JWT approach to reduce synchronization overhead—useful for IoT and microservices. Strengths include scalability, broad authentication support, UMA integration, and even extensibility to physical access control, while challenges include lack of SaaS offering and operational complexity requiring command-line tooling for upgrades and environment promotion.

• IAM commonly spans provisioning, identity repositories, authentication, authorization, WAM, federation/SSO, governance, reconciliation, and risk management.
• Common IAM standards include SCIM for provisioning and LDAP for user identity storage.
• Authentication standards and mechanisms listed include Kerberos, RADIUS, PKI/X.509 (including SmartCards), and FIDO U2F/UAF.
• Federation standards listed include SAML, OAuth, OpenID, and OpenID Connect.
• Authorization standards listed include XACML and UMA (User Managed Access).
• ForgeRock was founded in 2010 by former Sun Microsystems employees after the Oracle acquisition.
• ForgeRock Access Management provides WAM and SSO and works with ForgeRock Identity Gateway to deliver federation functionality.
• The risk engine evaluates signals such as idle time, device fingerprints, geo-location, time of day, time zone, and user/device history.
• ForgeRock Access Management is mostly XACML 3.0 conformant, supports the “Advice” element, and does not support the “Obligations” element.
• ForgeRock offers OpenAM as open source and offers subscription support for ForgeRock Access Management built from OpenAM.

• “Identity and Access Management (IAM) is a foundational element of cybersecurity today.”
• “Many of the components of IAM have become standardized and even commoditized.”
• “UMA, a Kantara Initiative standard, provides a framework to obtain consent from users how their information can be used.”
• “ForgeRock Access Management is ForgeRock’s Web Access Management (WAM) and Single Sign-On (SSO) product.”
• “Authenticators can be chained together via customizable policies.”
• “Risk analysis can take place in ForgeRock Access Management at authorization or authentication time.”
• “This eliminates the state synchronization traffic while providing a similar experience to the user (or device).”
• “JWTs can have longer time-to-live (TTL) values than are typically found in WAM cookies.”
• “ForgeRock Access Management is a full-featured access management product.”
• “For enterprise deployments, a support contract is recommended.”