What is Social Authentication in ForgeRock AM and how does it work?

Social Authentication in ForgeRock AM allows users to log in using accounts from external identity providers — Google, Apple, Facebook, Twitter/X, LinkedIn, GitHub, and others — without creating a new credential in AM's own directory. AM acts as an OAuth2/OIDC relying party to the social provider and maps the received identity claims into its own user session.

The flow for a typical Google login via AM:

1. User selects "Sign in with Google" on the AM login page.
2. AM redirects the user to Google's authorization endpoint with AM's OAuth2 client credentials and a state parameter.
3. User authenticates to Google and consents to sharing profile data.
4. Google redirects back to AM's callback URL with an authorization code.
5. AM exchanges the code for tokens at Google's token endpoint.
6. AM calls Google's UserInfo endpoint to retrieve the user's profile (sub, email, name).
7. The Social Provider Handler node in the AM authentication tree processes the profile.
8. The Provision Dynamic Account node creates a transient or persistent user profile in AM's identity store.
9. AM creates a session and returns the session cookie to the user's browser.

Configuration in AM involves:

• Registering AM as an OAuth2 application with the social provider (obtaining client ID + secret).
• Creating an Identity Provider configuration in AM for the social provider (AM 6.5+ uses the Social Identity Provider Service, earlier versions used the Social Authentication module).
• Building an authentication tree that includes the Social Provider Handler and an account provisioning/resolution node.

For JIT (Just-In-Time) provisioning, AM can automatically create a user account in DS the first time a social user logs in, using attributes from the social profile. For existing enterprise users, a profile lookup and linking step maps the social identity to an existing account.