What is User Managed Access (UMA) in ForgeRock AM?

User Managed Access (UMA) is an OAuth 2.0-based access control protocol (standardised as UMA 2.0 by the Kantara Initiative) that enables a resource owner — a regular end user — to control who can access their resources (data, APIs, documents) and under what conditions, without involving the resource owner in every access transaction. ForgeRock AM implements UMA as an extension to its OAuth2 Authorization Server.

UMA introduces three actors beyond standard OAuth2:

• Resource Owner (RO) — The user whose resources are being protected. They register resources and grant access to specific parties.
• Resource Server (RS) — The server hosting the protected resources. It calls AM to validate Requesting Party Tokens.
• Requesting Party (RqP) — The entity (user or application) trying to access the resource on behalf of someone else.

The UMA flow in ForgeRock AM:

1. The Resource Owner registers their resource with AM's Resource Registration Endpoint, obtaining a resource ID.
2. The RO sets permissions — who (which client or user) can access the resource and under what scopes.
3. A Requesting Party client attempts to access the resource at the Resource Server.
4. The RS checks for a Requesting Party Token (RPT) — if absent, it obtains a Permission Ticket from AM.
5. The Requesting Party exchanges the Permission Ticket at AM's token endpoint, triggering an authorization interaction (possibly requiring RO approval).
6. AM issues an RPT if the RO's permissions allow it.
7. The RS validates the RPT with AM and grants access.

UMA is used in healthcare (patients sharing medical records with providers), financial services (sharing account data with third-party apps), and any scenario where end users need delegated sharing control rather than having an administrator grant access.