How does ForgeRock AM handle Multi-Factor Authentication (MFA)?

ForgeRock AM implements MFA through its Authentication Trees (Journeys). Rather than configuring MFA as a flag, you compose a tree that explicitly collects a first factor (typically username + password), makes a routing decision (risk score, user enrollment status, IP check), and then presents a second-factor challenge if required. This compositional model makes MFA more flexible than traditional module-based MFA.

Supported second factors in AM:

• OATH TOTP / HOTP — Time-based (Google Authenticator, Authy) or counter-based OTPs using the OATH Token Verifier node. Requires prior enrollment via the OATH Registration node.
• Push Notification — Approve/deny push to the ForgeRock Authenticator mobile app. Uses the Push Sender node to dispatch the challenge and Push Result Verifier to wait for the response.
• WebAuthn (FIDO2) — Hardware security keys (YubiKey) or biometric platform authenticators (Touch ID, Face ID, Windows Hello). Uses WebAuthn Registration and Authentication nodes.
• Email OTP / SMS OTP — One-time codes sent to a registered email address or phone number using OTP Email Sender / OTP SMS Sender nodes.
• Backup Codes — Pre-generated single-use codes for account recovery.

A typical adaptive MFA tree design:

1. Collect username → look up user in identity store.
2. Evaluate risk (IP reputation, device fingerprint, geolocation).
3. If risk is low → single-factor success.
4. If risk is medium → prompt for TOTP.
5. If risk is high or unrecognised device → push notification approval.

Step-up authentication is a variant where a user with an existing low-assurance session is asked to re-authenticate with a second factor to access a sensitive resource. AM supports this via policy conditions that check the AuthLevel of the current session.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.