What is the difference between AM 6.x authentication chains/modules and AM 7.x authentication trees?

The shift from authentication chains and modules (AM 6.x and earlier) to authentication trees and nodes (AM 6.5+ / 7.x) represents a fundamental redesign of how ForgeRock AM models authentication flows. Understanding the difference is critical in interviews because many enterprise installations are still mid-migration.

Authentication Chains + Modules (6.x legacy model):
A chain is an ordered list of modules, each with an iRequired flag value: REQUIRED, OPTIONAL, REQUISITE, or SUFFICIENT. These flags (borrowed from JAAS) control how failures propagate through the chain. A module is a Java class that performs a single authentication action and returns a Passed/Failed/Incomplete status. The control flow logic is implicit in the flag model — you cannot branch to a completely different module based on a condition, and you cannot easily implement "if password succeeds, skip OTP for this IP range" without customisation.

Authentication Trees + Nodes (7.x / Journeys model):
A tree is a directed graph of nodes. Each node has explicitly named outcome ports. A "Username Collector" node has a single outcome; a "Data Store Decision" node has "True" (success) and "False" (failure) outcomes; a "Scripted Decision" node can have any number of custom named outcomes. The next node in the flow is determined by which outcome path the current node emits. This gives full conditional branching — you can route to different paths based on user type, device, risk score, or any attribute in shared state.

Key practical differences:

• Trees support inner trees (embedding one tree in another); chains cannot be nested.
• Trees have a visual editor in the AM console; chains are text configuration.
• Custom nodes in trees are OSGi bundles; custom modules in chains are JAR files loaded via the classpath.
• Modules have context-aware flag logic; nodes have explicit outcome edges — more verbose but clearer.
• Modules are still supported in AM 7.x for backwards compatibility but receive no new development. Trees are the only supported model for new features like WebAuthn, Push, and Device Fingerprint.