What is ForgeRock Identity Gateway (IG) and how does it protect legacy applications?

ForgeRock Identity Gateway (IG) is a reverse proxy and API gateway that sits between clients and backend applications. Its primary purpose is to enforce OAuth2-based access control, session validation, and protocol transformation for applications that cannot natively integrate with modern identity protocols. It evolved from the OpenIG project and shares the same route-based configuration model.

IG protects legacy applications through several mechanisms:

OAuth2 Token Relay — IG intercepts inbound requests, validates the OAuth2 bearer token against AM's introspection endpoint or by verifying the JWT signature locally, and then either passes the request through or forwards user identity information to the backend via HTTP headers. The legacy app never sees the OAuth2 token — it just receives trusted headers like X-Forwarded-User or a custom header with the user's roles.

Login Form Replay — For very old applications with HTML login forms and no API, IG can capture credentials from a modern SAML or OAuth2 login flow and replay them into the legacy form — essentially driving the form submission on behalf of the user. This enables SSO for applications that cannot be modified.

SAML 2.0 Federation — IG can act as a SAML Service Provider in front of a backend application, consuming SAML assertions from AM and translating them into the backend application's expected format (headers, cookies, or request attributes).

Session Injection — IG can request a session from AM on behalf of a user and inject a session cookie into the response, making the backend application believe the user authenticated directly with it.

IG's configuration is JSON-based and consists of Routes (URL pattern matchers) and Filter Chains (ordered sequences of handlers and filters). This declarative model makes IG configuration fully scriptable and GitOps-friendly.