This 1-minute video shows how users can enjoy a secure, passwordless login experience to workstations and web applications when customers deploy TruU with ForgeRock Access Management.

This deployment guide details how to configure the TruU ForgeRock Plugin with ForgeRock for biometric based identity verification to federated resources. The TruU ForgeRock Plugin enables ForgeRock to communicate with your TruU Identity Server(s) and the TruU Identity Platform in order to provide authentication decisions to ForgeRock applications.

At a high level, you will perform the following steps to deploy a TruU ForgeRock Plugin, (the detailed instructions are in the ensuing pages of this guide):

1. Creating a TruU ForgeRock Plugin from the TruU Admin Console
2. Deploying TruU Plugins in the ForgeRock server
3. Managing a TruU ForgeRock Plugin in the TruU Admin Console

• ForgeRock Access Management 6.5 or 7

The TruU ForgeRock Plugin communicates with the TruU Identity Server for authentication decisions and to validate OAuth tokens used for authorizing communication between all TruU software deployed in your organization. Open the required firewall ports below to enable communication with your TruU infrastructure.

The TruU ForgeRock Plugin enables integration with third-party resources that support the protocol. When configured for ForgeRock, an Administrator can delegate authentication of ForgeRock protected resources to TruU where TruU validates the identity of users via biometrics.

1. Log into your TruU Admin Console and navigate to 'Settings' > 'Integrations' tab.

2. Next, navigate to ‘Adapters’ tab, then click (+) to create a new TruU adapter instance.

3. Select the 'Single Sign On' adapter, then select the 'ForgeRock' adapter type from the dropdown menu. Enter a unique name for the adapter (e.g. ForgeRock), confirm your Identity Server URL, then confirm your FIDO origin. Click 'Create'. If prompted, select the appropriate TruU console administrator role(s) to manage the adapter. Click 'Apply' to save the configuration and select both checkboxes in order to download all files and agree to the EULA. Finally click 'Download and Finish' to download a .ZIP file containing the plugin and a configuration file to be used within the ForgeRock administration console.

The TruU ForgeRock Plugin is a custom Java application that runs on your ForgeRock server. The plugin enables the TruU Identity Server to provide authentication decisions for any ForgeRock application using the plugin.

1. Unzip the TruU ForgeRock Plugin files and copy files to the ForgeRock directory below:

    $ unzip truu-forgerock-adapter-XX.XX.zip
    $ cp truu-identity-XX.XX-nodes.jar <YourForgeRockInstallFolder>/tomcat/webapps/openam/WEB-INF/lib/
   

2. Restart the ForgeRock server to initialize the TruU ForgeRock Plugin.

ForgeRock plugins enable specific authentication flows to one or more federated applications using the plugin. An Administrator can configure one or more federated applications with a TruU Plugin in order to enforce an authentication flow that requires a user to provide their identity using biometrics or FluidID (behavior).

TruU supports the following directories and user attributes:

• Active Directory (userPrincipalName)
• Azure Active Directory (userPrincipalName)
• Okta (login)

Once a user completes TruU authentication, the TruU Identity Server will return the aforementioned user attribute to ForgeRock Access Management. We recommend sharing the same user directory between Access Management and your TruU Identity Server, or using ForgeRock Identity Management to reconcile identities between directories.

The following steps describe how a ForgeRock Access Management administrator can import the recommended TruU authentication tree using the truu-identity.json template. You will need the Access Management utility amtree.sh, which can be downloaded from https://github.com/vscheuber/AM-treetool.

1. Copy the truu-identity.json template (included in the truu-forgerock-adapter-XX.XX.zip package) to the directory from which you will run the amtree.sh tool.

2. Run the following command, replacing the Access Management hostname and administrator credentials with values appropriate in your environment:

    $ ./amtree.sh -h http://openam.example.com:8080/openam -u amadmin -p password -i TruuAuthentication -f truu-identity.json
   

3. Log into your Access Management console, navigate to the imported tree, and update the configuration values for the TruU Identity Request Node (enter the Identity Server URL, client ID and client secret) and the TruU WebAuthn Node (enter the relying party origin).

The following steps describe how an administrator within ForgeRock Access Management can create a tree for TruU authentication.

1. Log into your ForgeRock Admin Portal and navigate to 'Authentication' > 'Trees' and create a new tree for TruU.

2. Create the following tree for TruU:

3. Complete the required ForgeRock fields using the configuration file downloaded from your TruU Admin Console.

Standard ForgeRock Authentication Nodes

4. Click 'Save' to complete.

1. To edit an existing TruU ForgeRock Plugin adapter in your TruU Admin Console, click on the adapter instance. Once clicked, you can edit the adapter name, change the FIDO Origin and/or toggle the adapter from 'Active' to 'Inactive'.

2. To delete an existing TruU ForgeRock Plugin adapter in your TruU Admin Console, click on the adapter instance and then change the 'Active' toggle to 'Inactive'. Click 'Save'.

3. Disable the 'Show Only Active Adapters' toggle to display the inactive ForgeRock adapter.

4. Click the checkbox next to the inactive ForgeRock adapter and click 'Delete' from the 'Actions' menu.

5. Click 'Accept' to delete the ForgeRock adapter.