Access Management and Federation

Access Management and Identity Federation are positioned as foundational technologies for the “Connected and Intelligent Enterprise,” where organizations must securely collaborate with partners, customers, and cloud services while supporting mobile work and rapidly changing attack patterns. Although Web Access Management (WAM) is mature and long established, adoption of both WAM and federation has accelerated because business teams increasingly drive requirements such as partner onboarding, customer access, cloud access, and social login. The market is evolving toward broader feature sets: self-registration, reverse proxy and Web Application Firewall add-ons, API authorization interfaces, and modern standards such as OAuth 2.0, OpenID Connect, and UMA. The report focuses on on-premises solutions (while treating SaaS availability as a positive), emphasizing that federation is strategically central, but WAM remains critical for legacy on-prem applications that cannot directly support federation.

Evaluation criteria span inbound/outbound federation, backend integration methods (APIs, header injection), adaptive/risk-based authentication, registration workflows, directory and virtual directory flexibility, security and policy models, deployment flexibility (appliances, cloud/MSP), customization vs coding, and multi-tenancy. Vendor selection should not rely solely on leadership placement; thorough requirement mapping plus proof-of-concept is recommended.

Overall Leaders are CA Technologies, ForgeRock, IBM, Micro Focus, and Ping Identity; Innovation Leaders are ForgeRock, Ping Identity, and IBM. The market is described as mature, crowded, and differentiated by niche innovation, ecosystem strength, and geographic reach. Correlated views highlight “Market Champions” (IBM, CA, Micro Focus) and identify vendors that overperform in product capability relative to market presence. Product writeups show common patterns: strong WAM and federation often require additional modules for advanced authentication, reporting depth varies widely, and global reach/partner ecosystems frequently constrain otherwise capable regional vendors.

• The Leadership Compass evaluates solutions that are available on premises, while treating cloud/SaaS versions as a positive feature.
• Access Management typically sits in front of web applications to handle authentication and usually coarse-grained authorization for backend applications.
• Identity Federation splits authentication and authorization between an Identity Provider (IdP) and a Service Provider (SP) or Relying Party (RP) using protocol-based communication.
• Federation standards and related protocols highlighted include SAML 2.0, OAuth 2.0, OpenID Connect, and UMA.
• Overall Leaders listed are CA Technologies, ForgeRock, IBM, Micro Focus, and Ping Identity.
• Innovation Leaders listed are ForgeRock, IBM, and Ping Identity.
• The Overall Leadership chart includes 15 vendors and places no vendor in the Followers section.
• Product Leaders listed include AdNovum, CA Technologies, Ergon, Evidian, ForgeRock, IBM, Micro Focus, Oracle, Ping Identity, and WSO2.
• Two vendors are placed in the Innovation Followers section: F5 Networks and Ubisecure.
• IBM Security Access Manager is described as a mature product with nearly 20 years in the market.

• “Access Management and Federation are moving from tactical IT challenges towards strategic infrastructure elements that enable business agility.”
• “The business challenge to solve is how to support the growing ‘Connected and Intelligent Enterprise’.”
• “Thus, especially Identity Federation is a technology that is essential for any organization.”
• “Web Access Management is a rather traditional approach that puts a layer in front of web applications that takes over authentication and – usually coarse-grained – authorization management.”
• “The less you need to code and the more you can configure, the better – that’s the simple equation we took into account around customization.”
• “Selecting a vendor of a product or service must not be only based on the comparison provided by a KuppingerCole Leadership Compass.”
• “Leadership does not automatically mean that these vendors are the best fit for a specific customer requirement.”
• “Given the maturity of Web Access Management and Identity Federation solutions, the amount of innovation we see is limited.”
• “Vendors below the line show, based on their ability to innovate, the biggest potential for improving their market position.”
• “These technologies are enabling technologies for business requirements such as agility, compliance, innovation… and the underlying collaboration & communication.”