Tools / ForgeRock IAM interview questions
What is ForgeRock AM scripting and what languages are supported?
ForgeRock AM supports server-side scripting at multiple points in its processing pipeline, allowing administrators and developers to customise authentication, authorization, and OIDC behaviour without modifying AM's source code. Scripts run in a sandboxed environment with a restricted API surface — they can access AM's shared state, make HTTP calls to external services, query the identity store, and manipulate tokens, but they cannot perform arbitrary JVM operations.
Supported scripting languages:
- JavaScript (Nashorn) — Runs via the JVM-embedded Nashorn JavaScript engine (Java 8–11). Nashorn was deprecated in Java 11 and removed in Java 15, so AM 7.x migrated to the Rhino engine for JavaScript execution.
- Groovy — Apache Groovy, which runs natively on the JVM. Groovy scripts have access to Java libraries and tend to have better IDE support and compile-time checking than JavaScript for complex logic.
Script types and their contexts:
| Script Type | Where Used |
|---|---|
| Authentication Tree Decision Node | Scripted Decision Node in authentication trees; accesses sharedState, transientState, callbacks, and identity attributes |
| OIDC Claims Script | Runs during token issuance to add, remove, or transform claims in the ID token and UserInfo response |
| OAuth2 Access Token Modification Script | Customises the claims in OAuth2 access tokens (JWT format) |
| Authorization Policy Condition | Scripted policy conditions for dynamic authorization logic |
| Authorization Policy Environment Condition | Context-aware environmental checks in policies |
| Social Identity Provider Profile Transformation | Transforms raw social profile JSON into AM-normalised attributes |
Scripts are managed in the AM admin console under Realms → Scripts and can be versioned, shared across trees, and validated with a built-in syntax checker. In AM 7.3+, scripts can be tested directly in the console before deployment.
More Related questions...
