Tools / ForgeRock IAM interview questions
1. What is ForgeRock IAM and what are its core platform components?
ForgeRock is an enterprise Identity and Access Management (IAM) platform that provides a full suite of identity services — authentication, authorization, identity governance, directory services, and API gateway capabilities — all under a single integrated product family. It is now part of Ping Id...
2. What is ForgeRock Access Management (AM) and what protocols does it support?
ForgeRock Access Management (AM) is the authentication and authorization hub of the ForgeRock platform. It is the component that users actually interact with when logging in, and the one that downstream applications call to validate sessions and enforce access policies. AM evolved from the open-s...
3. What are Authentication Trees (Journeys) in ForgeRock AM and how do they differ from the older module-based authentication?
Authentication Trees — rebranded as Journeys in AM 7.x — are the modern way to design authentication flows in ForgeRock AM. Introduced in AM 6.5, they replace the legacy authentication chain + module model with a visual node-based graph. Each tree is a directed acyclic graph (DAG) where every nod...
4. What is a ForgeRock AM Realm and what is it used for?
A Realm in ForgeRock AM is an administrative boundary that provides isolated configuration of identity stores, authentication trees, OAuth2 providers, policies, and agents. Every AM installation has a top-level root realm (denoted / ), and administrators can create any number of sub-realms undern...
5. How does ForgeRock AM implement OAuth 2.0 and what grant types does it support?
ForgeRock AM acts as a fully compliant OAuth 2.0 Authorization Server. It issues access tokens, refresh tokens, and (when OIDC is enabled) ID tokens. The OAuth2 provider is configured per-realm, which means different business units can have different token lifetimes, signing keys, PKCE requiremen...
6. What is the Core Token Service (CTS) in ForgeRock AM and what does it store?
The Core Token Service (CTS) is the central token storage layer in ForgeRock AM. It is a key-value store backed by ForgeRock Directory Services (DS) that persists all transient token and session state that AM needs to maintain across cluster nodes. Without a shared CTS store, an AM cluster cannot...
7. What is ForgeRock Identity Management (IDM) and what is its role in the platform?
ForgeRock Identity Management (IDM) is the lifecycle and provisioning engine of the ForgeRock platform. Where AM focuses on authentication and access decisions in real time, IDM manages the full identity lifecycle — creating accounts when a new employee joins, updating attributes when roles chang...
8. What is ForgeRock Directory Services (DS) and how does it differ from a standard LDAP server?
ForgeRock Directory Services (DS) is a high-performance, highly available LDAP and REST directory server evolved from the OpenDJ project. While it is fully LDAP v3 compliant and can serve as a general-purpose directory, several architectural decisions make it significantly different from traditio...
9. What is ForgeRock Identity Gateway (IG) and how does it protect legacy applications?
ForgeRock Identity Gateway (IG) is a reverse proxy and API gateway that sits between clients and backend applications. Its primary purpose is to enforce OAuth2-based access control, session validation, and protocol transformation for applications that cannot natively integrate with modern identit...
10. What are Authentication Nodes in ForgeRock AM and can you name commonly used ones?
Authentication Nodes are the individual building blocks of Authentication Trees (Journeys) in ForgeRock AM. Each node encapsulates a single, discrete authentication or decision task. It accepts shared state (a map of context attributes), performs its operation, and emits one of its defined outcom...
11. What is OpenID Connect (OIDC) in ForgeRock AM and how does it differ from OAuth 2.0?
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0. Where OAuth 2.0 only answers the question "what can this application access?", OIDC additionally answers "who is the logged-in user?" ForgeRock AM acts as an OIDC Provider (OP), issuing ID tokens that carry authenticated user i...
12. What is SAML 2.0 federation in ForgeRock AM and how do you configure a Service Provider?
SAML 2.0 (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). ForgeRock AM supports SAML 2.0 as both IdP and SP, making it suitable for B2B federation, connecting enterpri...
13. What are ForgeRock AM Policies and Policy Sets?
ForgeRock AM's policy engine provides fine-grained authorization (FGAC) — the ability to define rules that control which subjects can perform which actions on which resources, and under what conditions. This is distinct from authentication (proving who you are); policies govern what you are allow...
14. What are Java Agents and Web Agents in ForgeRock AM?
Java Agents and Web Agents are Policy Enforcement Points (PEPs) that integrate directly with application servers and web servers to enforce ForgeRock AM authentication and authorization decisions without requiring changes to the application code. Java Agent — Installed as a Java EE filter (a JVM-...
15. How does ForgeRock AM handle Multi-Factor Authentication (MFA)?
ForgeRock AM implements MFA through its Authentication Trees (Journeys). Rather than configuring MFA as a flag, you compose a tree that explicitly collects a first factor (typically username + password), makes a routing decision (risk score, user enrollment status, IP check), and then presents a ...
16. What is Social Authentication in ForgeRock AM and how does it work?
Social Authentication in ForgeRock AM allows users to log in using accounts from external identity providers — Google, Apple, Facebook, Twitter/X, LinkedIn, GitHub, and others — without creating a new credential in AM's own directory. AM acts as an OAuth2/OIDC relying party to the social provider...
17. What is ForgeRock AM scripting and what languages are supported?
ForgeRock AM supports server-side scripting at multiple points in its processing pipeline, allowing administrators and developers to customise authentication, authorization, and OIDC behaviour without modifying AM's source code. Scripts run in a sandboxed environment with a restricted API surface...
18. What is ForgeRock DS replication and how does it work?
ForgeRock Directory Services (DS) replication is the mechanism by which data written to one DS server is automatically propagated to all other servers in the replication topology. It enables high availability and geographic distribution — applications can connect to any DS node and always read co...
19. What is ForgeRock IDM reconciliation and how do you configure it?
Reconciliation in ForgeRock IDM is the process of comparing two populations — a source (typically managed users in IDM's repository) and a target (an external system accessed via a connector) — and taking configured actions to bring them into alignment. It is the batch, on-demand, or scheduled me...
20. What are Managed Objects in ForgeRock IDM?
Managed Objects are the identity entities that ForgeRock IDM owns and governs in its internal repository. Unlike System Objects (which are projections of data from external systems via connectors), Managed Objects are the canonical, authoritative representation of an identity within IDM. IDM pers...
21. What is ForgeRock AM's Session Management and what types of sessions exist?
Session management in ForgeRock AM refers to the lifecycle of the authentication state a user establishes after successfully completing an authentication tree. When a user authenticates, AM creates a session and returns a session token to the client (typically as a cookie named iPlanetDirectoryPr...
22. What is PKCE in ForgeRock AM and why is it important for public clients?
PKCE stands for Proof Key for Code Exchange (RFC 7636). It is a security extension to the OAuth 2.0 Authorization Code flow that protects against the authorization code interception attack — a threat where a malicious app on the same device intercepts the authorization code before the legitimate ...
23. What is ForgeRock Identity Cloud and how does it relate to ForgeRock Server?
ForgeRock Identity Cloud, now branded as PingOne Advanced Identity Cloud , is ForgeRock's fully managed SaaS IAM platform. It provides the same core ForgeRock capabilities — Access Management (AM), Identity Management (IDM), and Directory Services (DS) — delivered as a cloud-native, multi-tenant ...
24. What is User Managed Access (UMA) in ForgeRock AM?
User Managed Access (UMA) is an OAuth 2.0-based access control protocol (standardised as UMA 2.0 by the Kantara Initiative) that enables a resource owner — a regular end user — to control who can access their resources (data, APIs, documents) and under what conditions, without involving the resou...
25. How does ForgeRock AM support Adaptive Authentication?
Adaptive authentication (also called risk-based authentication) in ForgeRock AM is the practice of adjusting the authentication challenge based on real-time contextual risk signals. Instead of requiring every user to pass a fixed MFA challenge, AM evaluates risk factors and demands a stronger pro...
26. What is the ForgeRock Autonomous Identity product?
ForgeRock Autonomous Identity (AI-driven) is a separate analytical product in the ForgeRock portfolio that uses machine learning to analyse identity data and access patterns to support identity governance decisions. It was designed to solve one of the most persistent problems in identity governan...
27. What is the difference between Authentication Level and Authentication Context in ForgeRock AM?
Authentication Level and Authentication Context Class Reference (ACR) are two related but distinct ways ForgeRock AM classifies the strength of an authentication event. Both are recorded in the session and in tokens, and both can be used in access policies and step-up authentication flows. They c...
28. How does ForgeRock AM Token Exchange (RFC 8693) work?
Token Exchange (RFC 8693) is an OAuth 2.0 extension grant type that allows a client to exchange one security token for a different one with different properties — different subject, different scopes, different lifetime, or a different format. ForgeRock AM 7.x supports the Token Exchange grant nat...
29. What is the ForgeRock Identity Gateway Route configuration and how does it work?
ForgeRock Identity Gateway (IG) is configured through a route-based model. Every inbound HTTP request is matched against a set of Routes, and the first matching route's handler chain processes the request. Routes are defined as JSON files (or via the Studio UI) stored in IG's configuration direct...
30. What are ForgeRock IDM's password policy capabilities?
ForgeRock IDM provides a comprehensive password policy engine for managing password requirements on Managed User objects. Unlike AM's authentication-time password validation, IDM's policies govern the passwords stored in IDM's managed repository — enforcing rules at account creation, self-service...
31. What is the ForgeRock CDK (Cloud Deployment Kit) and what does it provide?
The ForgeRock Cloud Deployment Kit (CDK) is a set of Kubernetes-native tooling, Helm charts, Kustomize overlays, and operator resources that enable automated, repeatable deployment of the ForgeRock Identity Platform (AM, DS, IDM, and IG) on Kubernetes clusters. It is the reference deployment arch...
32. What is the difference between AM 6.x authentication chains/modules and AM 7.x authentication trees?
The shift from authentication chains and modules (AM 6.x and earlier) to authentication trees and nodes (AM 6.5+ / 7.x) represents a fundamental redesign of how ForgeRock AM models authentication flows. Understanding the difference is critical in interviews because many enterprise installations a...
