ForgeRock Identity Gateway

ForgeRock is a privately held identity and access management (IAM) vendor headquartered in San Francisco, founded in 2010 in Norway by former Sun Microsystems employees after Oracle’s acquisition, aiming to keep Sun’s identity products from being phased out. The company built a unified, open source–based IAM stack and shipped the complete ForgeRock Identity Platform by 2013. It has grown into a globally present IAM provider with offices across the USA, UK, Germany, France, Norway, Singapore, and Australia, and positions itself as distinct from “suites” assembled through acquisitions by offering a genuinely unified platform for managing many identity types—people, devices, applications, and smart things.

ForgeRock’s platform strategy responds to digital transformation pressures that strain loosely coupled enterprise IAM infrastructures, especially around multiple identity types, IoT interaction, and privacy/consent. Its next-generation “Identity Relationship Management” approach extends IAM concepts to internet scale, supports new partner/consumer/device communication channels, and embeds user-managed access to raise trust beyond compliance. Built on open standards and open source licensing, the platform is modular but integrated, with shared services (common interfaces, GUI, APIs, scripting, logging, auditing) underpinning core products: Access Management (OpenAM), Identity Management (OpenIDM), User-Managed Access (OpenUMA), Directory Services (OpenDJ), and Identity Gateway (OpenIG).

ForgeRock Identity Gateway (commercialized from OpenIG) is positioned as business-critical for extending authentication and authorization beyond the corporate perimeter, including to legacy applications lacking modern identity standards. As a reverse HTTP proxy, it inspects and transforms requests to enforce centralized policies without deploying agents or rewriting apps. It supports SSO, SAMLv2, OAuth 2.0, OpenID Connect, token translation (via Secure Token Service), throttling, basic message transformations, IoT-scale scenarios, and password capture/replay for legacy integration—while notably lacking advanced threat detection and mitigation expected of a full enterprise API gateway.

• ForgeRock is privately held and headquartered in San Francisco, California, USA.
• The company was founded in 2010 in Norway by former Sun Microsystems employees.
• The complete ForgeRock Identity Platform shipped by 2013.
• ForgeRock has offices in the USA, UK, Germany, France, Norway, Singapore, and Australia.
• The ForgeRock Trust Network includes over 70 technology partners, system integrators, and OEM partners worldwide.
• ForgeRock Identity Gateway is the commercial release built from the open source OpenIG project.
• The gateway is built on reverse HTTP proxy technology that captures traffic and inspects/transforms requests.
• In basic standalone configuration, the gateway can act as a Single Sign-On frontend for web apps and API endpoints.
• Built-in security features are limited to throttling to help prevent denial of service attacks.
• ForgeRock Identity Gateway supports password capture and replay to enable SSO for legacy web applications.

• “ForgeRock is one of the very few players in the market that is able to offer a unified platform for managing all types of digital identities - people, devices, applications or smart things”
• “traditional loosely coupled enterprise IAM infrastructures are no longer capable of keeping up with the latest challenges”
• “ForgeRock’s answer to these challenges is their next-generation ‘Identity Relationship Management’ platform”
• “built upon the reverse HTTP proxy technology, which means capturing the traffic”
• “This centralized enforcement point eliminates the need to deploy various agents on target systems or to modify existing applications.”
• “Unfortunately, the product lacks any more sophisticated security features like threat detection or malware protection.”
• “Where the product does shine is in projects which take advantage of the ForgeRock platform’s massive scalability.”
• “an additional security layer can be added around them, which ensures that access management policies can be enforced without modifying the applications.”
• “The only major shortcoming we can recognize is the almost complete lack of threat detection and mitigation capabilities”
• “With the rapidly growing API economy, protecting the backend services from external and internal threats is becoming more important.”