Cross-Domain Single Sign-On With the ForgeRock Identity Cloud

For organizations relying on AM's session and policy services with SSO, consider cross-Domain Single Sign-On (CDSSO) as an alternative to SSO through OpenID Connect.

This example sets up ForgeRock Identity Cloud as an SSO authentication server for requests processed by Identity Gateway. For more information about about Identity Gateway and CDSSO, see "Authenticating With CDSSO".

Before you start, prepare Identity Cloud, Identity Gateway, and the sample application as described in "Example Installation for This Guide".

  1. Set up Identity Cloud:

    1. Log in to the ForgeRock Identity Cloud as an administrator.

    2. In the platform console, go to Identities > Manage > Alpha realm - Users, and add a new user with the following values:

      • Username: demo

      • First name: demo

      • Last name: user

      • Email Address:

      • Password: Ch4ng3!t

    3. Make sure that you are managing the alpha realm. If not, click the current realm at the top of the screen, and switch realm.

    4. Add an Identity Gateway agent:

      1. Click Gateways & Agents, and add an agent profile with the following values:

        • ID: ig_agent_cdsso

        • Password: password

        • Redirect URLs:

        By default, the agent can introspect OAuth 2.0 tokens issued to any client, in the realm and subrealm where it is created. To change the introspection, click Native Consoles > Access Management, and update the agent in the AM console.

  2. Set up Identity Gateway:

    1. Set an environment variable for the IG agent password, and then restart IG:

      $ export AGENT_SECRET_ID='cGFzc3dvcmQ='

      The password is retrieved by a SystemAndEnvSecretStore, and must be base64-encoded.

    2. Add the following route to IG, to serve .css and other static resources for the sample application:

        "name" : "sampleapp_resources",
        "baseURI" : "",
        "condition": "${matches(request.uri.path,'^/css')}",
        "handler": "ReverseProxyHandler"
    3. Add the following route to Identity Gateway, replacing the value for the property amInstanceUrl:

        "name": "cdsso-idc",
        "baseURI": "",
        "condition": "${matches(request.uri.path, '^/home/cdsso')}",
        "properties": {
          "amInstanceUrl": "<myIdentityCloudUrl/am>"
        "heap": [
            "name": "SystemAndEnvSecretStore-1",
            "type": "SystemAndEnvSecretStore"
            "name": "AmService-1",
            "type": "AmService",
            "config": {
              "url": "&{amInstanceUrl}",
              "realm": "/alpha",
              "version": "7",
              "agent": {
                "username": "ig_agent_cdsso",
                "passwordSecretId": ""
              "secretsProvider": "SystemAndEnvSecretStore-1",
              "sessionCache": {
                "enabled": false
        "handler": {
          "type": "Chain",
          "config": {
            "filters": [
                "name": "CrossDomainSingleSignOnFilter-1",
                "type": "CrossDomainSingleSignOnFilter",
                "config": {
                  "redirectEndpoint": "/home/cdsso/redirect",
                  "authCookie": {
                    "path": "/home",
                    "name": "ig-token-cookie"
                  "amService": "AmService-1",
                  "verificationSecretId": "verify",
                  "secretsProvider": {
                    "type": "JwkSetSecretStore",
                    "config": {
                      "jwkUrl": "&{amInstanceUrl}/oauth2/realms/alpha/connect/jwk_uri"
            "handler": "ReverseProxyHandler"

      Notice the following features of the route compared to cdsso.json in "Set Up CDSSO", where Access Management is running locally:

      • The AmService URL points to Access Management in the Identity Cloud.

      • The AmService realm points to the realm where you configure your IG agent.

  3. Test the setup:

    1. Go to The Identity Cloud login page is displayed.

    2. Log in to Identity Cloud as user demo, password Ch4ng3!t.

      Access Management calls /home/cdsso/redirect, and includes the CDSSO token. The CrossDomainSingleSignOnFilter passes the request to sample app.

Read a different version of :