What is Social Authentication in ForgeRock AM and how does it work?

Social Authentication in ForgeRock AM allows users to log in using accounts from external identity providers — Google, Apple, Facebook, Twitter/X, LinkedIn, GitHub, and others — without creating a new credential in AM's own directory. AM acts as an OAuth2/OIDC relying party to the social provider and maps the received identity claims into its own user session.

The flow for a typical Google login via AM:

1. User selects "Sign in with Google" on the AM login page.
2. AM redirects the user to Google's authorization endpoint with AM's OAuth2 client credentials and a state parameter.
3. User authenticates to Google and consents to sharing profile data.
4. Google redirects back to AM's callback URL with an authorization code.
5. AM exchanges the code for tokens at Google's token endpoint.
6. AM calls Google's UserInfo endpoint to retrieve the user's profile (sub, email, name).
7. The Social Provider Handler node in the AM authentication tree processes the profile.
8. The Provision Dynamic Account node creates a transient or persistent user profile in AM's identity store.
9. AM creates a session and returns the session cookie to the user's browser.

Configuration in AM involves:

• Registering AM as an OAuth2 application with the social provider (obtaining client ID + secret).
• Creating an Identity Provider configuration in AM for the social provider (AM 6.5+ uses the Social Identity Provider Service, earlier versions used the Social Authentication module).
• Building an authentication tree that includes the Social Provider Handler and an account provisioning/resolution node.

For JIT (Just-In-Time) provisioning, AM can automatically create a user account in DS the first time a social user logs in, using attributes from the social profile. For existing enterprise users, a profile lookup and linking step maps the social identity to an existing account.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.