How does ForgeRock AM handle Multi-Factor Authentication (MFA)?

ForgeRock AM implements MFA through its Authentication Trees (Journeys). Rather than configuring MFA as a flag, you compose a tree that explicitly collects a first factor (typically username + password), makes a routing decision (risk score, user enrollment status, IP check), and then presents a second-factor challenge if required. This compositional model makes MFA more flexible than traditional module-based MFA.

Supported second factors in AM:

• OATH TOTP / HOTP — Time-based (Google Authenticator, Authy) or counter-based OTPs using the OATH Token Verifier node. Requires prior enrollment via the OATH Registration node.
• Push Notification — Approve/deny push to the ForgeRock Authenticator mobile app. Uses the Push Sender node to dispatch the challenge and Push Result Verifier to wait for the response.
• WebAuthn (FIDO2) — Hardware security keys (YubiKey) or biometric platform authenticators (Touch ID, Face ID, Windows Hello). Uses WebAuthn Registration and Authentication nodes.
• Email OTP / SMS OTP — One-time codes sent to a registered email address or phone number using OTP Email Sender / OTP SMS Sender nodes.
• Backup Codes — Pre-generated single-use codes for account recovery.

A typical adaptive MFA tree design:

1. Collect username → look up user in identity store.
2. Evaluate risk (IP reputation, device fingerprint, geolocation).
3. If risk is low → single-factor success.
4. If risk is medium → prompt for TOTP.
5. If risk is high or unrecognised device → push notification approval.

Step-up authentication is a variant where a user with an existing low-assurance session is asked to re-authenticate with a second factor to access a sensitive resource. AM supports this via policy conditions that check the AuthLevel of the current session.