Tools / ForgeRock IAM interview questions
What are Authentication Trees (Journeys) in ForgeRock AM and how do they differ from the older module-based authentication?
Authentication Trees — rebranded as Journeys in AM 7.x — are the modern way to design authentication flows in ForgeRock AM. Introduced in AM 6.5, they replace the legacy authentication chain + module model with a visual node-based graph. Each tree is a directed acyclic graph (DAG) where every node performs a discrete task (collect a username, validate a password, check device fingerprint, send an OTP) and has one or more outcome paths that connect to the next node.
The key differences from the old module-based approach:
| Aspect | Chains + Modules (Legacy) | Trees / Journeys (Modern) |
|---|---|---|
| Flow model | Linear list of modules with REQUIRED/OPTIONAL/SUFFICIENT flags | Directed graph — any node outcome can branch to any other node |
| Conditional branching | Limited; flags control failure/success propagation | Full branching per outcome; scripted nodes enable dynamic routing |
| Re-use | Modules are shared but chains are isolated | Nodes are reusable; inner trees can be embedded in outer trees |
| MFA orchestration | Awkward; required extra modules and workarounds | Native — step-up, risk-based, and conditional MFA trivially expressed |
| Visual tooling | None — text configuration only | Drag-and-drop tree editor in AM admin console |
Trees also support inner trees (embedding one tree inside another as a node), which promotes reuse — for example a common MFA sub-tree shared across multiple top-level login journeys. The legacy chain model cannot be nested in this way. ForgeRock strongly recommends migrating all new deployments to trees; legacy modules are still supported for backwards compatibility but receive no new feature investment.
More Related questions...
