ForgeRock Access Management

Identity and Access Management (IAM) has evolved from basic user accounts and group membership into a specialized set of capabilities for authenticating, authorizing, auditing, and protecting identities at scale. Modern IAM spans provisioning and lifecycle management, identity repositories, access governance, federation and Single Sign-On (SSO), web access management (WAM), risk management, and integrations with other security systems. Many IAM elements are now standardized, with common protocols including SCIM for provisioning, LDAP for identity storage, Kerberos/RADIUS/PKI/FIDO for authentication, OAuth/OpenID Connect/SAML for federation, and XACML/JSON/JWT for authorization and policy expression.

IAM is frequently organized into Identity Management/IGA, Access Management, and Privileged Access Management (PAM). Access Management focuses on enabling secure access to services and delivering SSO by authenticating users on behalf of applications. Integration can be standards-based (federation) or, for legacy web apps, achieved through techniques like password injection or modified HTTPS headers. Key requirements include broad application support (SaaS to legacy), deployment flexibility (cloud and on-premises), and high scalability and availability—especially for B2C peak loads.

ForgeRock Access Management is positioned as an enterprise access management component within the broader ForgeRock Identity Platform, providing authentication, authorization, federation, entitlements, OAuth2/OIDC, SSO, session management, and web services security, integrating through shared administrative tooling and APIs. It supports diverse authenticators (including social login, smart cards, x.509, OTP, and FIDO) and enables adaptive, risk-aware policies through GUI-based Authentication Trees and Registration Trees. Risk decisions can incorporate third-party intelligence via an XACML-aligned architecture, and policies can be imported/exported as XACML and/or JSON. It offers stateful high-availability options but also mitigates state overhead by storing identity/context as client-held JWTs, supporting IoT and microservices use cases. Strengths include scalability, extensibility, standards breadth, and even integration with physical access control; challenges include operational complexity for upgrades and configuration promotion, plus a Mobile SDK noted as beta in 4Q2019.

• IAM technologies include provisioning, identity repositories, authentication, authorization, WAM, federation/SSO, governance, reconciliation, and risk management.
• Common IAM standards listed include SCIM, LDAP, Kerberos, RADIUS, PKI/x.509, FIDO U2F/UAF/2.0, OAuth, OpenID, OpenID Connect, SAML, UMA, XACML, JSON, and JWT.
• IAM is commonly divided into Identity Management/IGA, Access Management, and Privileged Access Management (PAM).
• ForgeRock Access Management delivers authentication, authorization, User Managed Access, federation, entitlements, OAuth2/OIDC communications, SSO, session management, and web services security.
• ForgeRock Identity Platform includes Common Services, Identity Lifecycle, Identity Gateway, Directory Services, and Edge Security.
• ForgeRock Access Management supports federation protocols including SAML, XACML, OAuth2, and OIDC.
• Authentication Trees and Registration Trees provide GUI-driven flows for authentication and registration.
• Risk evaluation can incorporate device fingerprints, device type, IP, and user attributes/history, with geo-location and geo-velocity requiring customization.
• Policies can be imported and exported as XACML and/or JSON.
• JWT-based identity/context storage keeps tokens on the client and supports the JWT profile of OAuth2 (RFC 7523).

• “IAM is a foundational element of cybersecurity today.”
• “Many of the components of IAM have become standardized and even commoditized.”
• “Access Management, also referred to as Web Access Management & Identity Federation, as one of the major disciplines is focused on providing access for users to services.”
• “A specific requirement for all types of Access Management is scalability and high availability.”
• “ForgeRock’s Identity Platform is designed with the notion that identity relationships and the management thereof are the key elements to secure and efficient IAM.”
• “The details of designing complex, risk-adaptive authentication and authorization rules are abstracted by the interface.”
• “Due to the nature of HTTP, most authentication and authorization transactions are stateless.”
• “JWTs are stored locally with the client, rather than on one or more servers.”
• “This JWT identity context storage method is increasingly important with the proliferation of IoT devices, which are not ‘always on’ and have limited computing power for maintaining and processing identity information.”
• “Given that ForgeRock Access Management is a platform component, with a broad feature set, effective administration and maintenance do require expertise and labor.”