What are Managed Objects in ForgeRock IDM?

Managed Objects are the identity entities that ForgeRock IDM owns and governs in its internal repository. Unlike System Objects (which are projections of data from external systems via connectors), Managed Objects are the canonical, authoritative representation of an identity within IDM. IDM persists them in its embedded database (OrientDB in older versions, or an external relational DB like PostgreSQL/MySQL in production deployments).

The most common managed objects in a typical deployment:

• Managed User (managed/user) — The core user identity object. Contains profile attributes (name, email, mobile), entitlement relationships (roles, assignments), account status, and password.
• Managed Role (managed/role) — Groups users and defines what entitlements (assignments) members receive. Roles can be static (explicit membership) or dynamic (membership determined by a query on user attributes).
• Managed Assignment (managed/assignment) — Defines what is provisioned to a target system when a user holds a role. For example, an "Employee" role might include an assignment that creates an LDAP account with specific group memberships.
• Managed Organisation / Group — Hierarchical organisational units for multi-tenant or enterprise deployments.

Managed object schemas are defined in managed.json. Each object type defines its properties, their types, validation rules, and encryption requirements. Password fields are automatically hashed using a configurable algorithm (PBKDF2, bcrypt, SHA-256). You can extend the schema by adding custom properties without modifying IDM's core — just edit managed.json.

All managed objects are accessible via IDM's REST API using the /openidm/managed endpoint: GET /openidm/managed/user?_queryFilter=userName eq "jdoe".