Guide to ForgeRock Identity Platform™ modules.

Authentication trees provide fine-grained authentication, social authentication, and multi-factor authentication. Trees are made up of authentication nodes. Authentication nodes allow multiple paths and decision points throughout the authentication flow, enabling AM to handle different modes of authenticating users.

Persistent access management sessions, authenticating the user until the session expires.

Session high availability is enabled by default with no setup required.

Capability to challenge for additional credentials when authentication takes place under centrally-defined risky or suspicious conditions.

Configuration storage in ForgeRock Directory Services for high-availability.

Bridges identities across web and enterprise identity access management (IAM) systems through a token transformation process, securely providing cross-system access to service resources by authenticated requesting applications.

Intercept requests to access protected resources and redirect for appropriate authentication.

Measure authentication flows using counters and start/stop timers to monitor performance.

Modern web-based policy editor for building policies, making it possible to add and update policies as needed without touching the underlying applications.

Access enforcement for online resources with the capability to require higher levels of authentication and session upgrade when accessing sensitive resources.

Requires a user to perform additional actions such as reauthenticating to a module or node, or responding to a push notification, to gain access to a protected resource.

A single OAuth 2.0 client configured for a comprehensive list of scopes can serve different scope subsets to resource owners based on policy conditions.

Identity federation with SaaS applications, such as Salesforce.com, Google Apps, WebEx, and many more.

Support for transmitting only attributes used by targeted applications.

OpenID Connect 1.0 compliance for running an OpenID Provider, including advanced profiles, such as Mobile Connect.

OAuth 2.0 compliance for running an authorization server.

For acting as an OAuth 2.0 client of social identity providers, such as Facebook, Google, and Microsoft.

A single OAuth 2.0 client configured for a comprehensive list of scopes can serve different scope subsets to resource owners based on policy conditions.

Conformance to the UMA 2.0 standard for interoperability with organizational and partner systems, including federated authorization and customer-centric use cases.

Authorization server with dynamic resource set registration, end user control of resource sharing, responses to access requests, and full audit history.

ForgeRock Identity Gateway protection for resources and services with the UMA 2.0 standard.

Synchronization of identity data across managed data stores.

Near real-time password synchronization across managed data stores.

Native password synchronization plugins for ForgeRock Directory Services and Microsoft Active Directory.

Grant role-based, limited access to perform fine-grained administrative tasks on managed objects.

Extensible interoperability for identity, compliance, and risk management across a variety of specific applications and services.

End-user self-service UI that lets users create their own accounts with customizable criteria.

End-user self-service UI for changing and resetting passwords based on predefined policies and security questions.

Verification for user identities based on predefined and end user-created security questions.

Mechanisms to allow users to recover their usernames with predefined policies.

Short forms used to simplify registration and incrementally collect profile data over time.

Dashboard for managing personal user information.

Standards-based Business Process Model and Notation 2.0 support.

Lightweight workflow and business process management platform.

Define provisioning workflows for self-service, sunrise and sunset processes, approvals, escalations, and maintenance.

Administrators can include any or all scopes available, by social identity provider.

Provisioning engine to import data from an external resource into IDM.

Ability to map IDM objects to tables in a JDBC database or to organizational units in a DS repository.

An extensible object model that enables you to manage the complete lifecycle of identity objects.

Ability to create and track relationship references between objects.

Provisioning roles to control how objects are exported to external systems and authorization roles to control authorization within IDM.

Entitlements to provision attributes or sets of attributes, based on role membership.

Administrators can create and manage entitlement bundles. Bundles are groups of entitlements to which users can request access.

Access Request can send customizable user notifications for specific events that occur within the request process.

The glossary provides consolidated management of entitlement metadata, bulk export and import, and extended relationship mapping.

Multi-stage certifications let any number of certifiers participate in access decision processes, and provide an escalation process to ensure timely responses.

An extensible glossary allows for consolidated management of role and entitlement metadata, bulk export and import, and extended relationship mapping.

Helps you meet compliance regulations and enables you to obtain a comprehensive understanding of your identity governance system. The reporting module includes a variety of reporting options such as systems access, certification, policy violations, and so on.

HTTP-based RESTful access to user data and server configuration.

Data replication for always-on services, enabling failover and disaster recovery.

Flexible key-value data model for storing users, devices, and things.

Password digests, encryption schemes, and customizable rules for password policy compliance to help protect data on disk and shared infrastructure.

Uniform view of underlying LDAPv3 directory services for client applications.

Configurable load balancing across directory servers with redundancy, and capabilities to handle referrals, connection failures, and network partitions.

Secure incoming and outgoing connections, and provide coarse-grained access control.

HTTP-based RESTful access to user data and server configuration.

Enforcement of centralized authorization policies for applications requiring Access Management.

Detection of requests to upgrade from HTTPS to the WebSocket protocol, and creation of a secure, dedicated tunnel to send and receive WebSocket traffic.

Protection for resources and services according to the UMA 2.0 standard.

Deployment of basic and customized configurations through Docker.

Protection and integration of APIs and applications with ForgeRock Identity Cloud for authentication and authorization.

Sidecar-type, container-optimized gateway for securing microservices.

Platform satellite for introspection of stateful and stateless OAuth 2.0 access tokens.