What is ForgeRock Access Management (AM) and what protocols does it support?

ForgeRock Access Management (AM) is the authentication and authorization hub of the ForgeRock platform. It is the component that users actually interact with when logging in, and the one that downstream applications call to validate sessions and enforce access policies. AM evolved from the open-source OpenAM project (itself rooted in Sun Microsystems' OpenSSO) and has grown into a full-featured identity provider and policy decision point.

AM supports a comprehensive set of identity and federation protocols:

• OAuth 2.0 — Token-based authorization framework; AM acts as both Authorization Server and Resource Server.
• OpenID Connect (OIDC) — Identity layer on top of OAuth 2.0; AM issues ID tokens and exposes a UserInfo endpoint.
• SAML 2.0 — XML-based SSO federation; AM can be both Identity Provider (IdP) and Service Provider (SP).
• WS-Federation / WS-Trust — Legacy Microsoft federation protocols for integration with AD FS environments.
• CAS (Central Authentication Service) — Widely used in academic environments; AM supports CAS SSO out of the box.
• FIDO2 / WebAuthn — Passwordless authentication using hardware security keys or platform authenticators.
• RADIUS — For VPN and network device authentication use cases.
• OATH (TOTP/HOTP) — Time-based and counter-based OTP for MFA flows.

AM also exposes comprehensive REST APIs so that custom applications can drive authentication, session management, and policy evaluation programmatically without going through the default UI flows.