All posts

ForgeRock Access Management (AM) is a powerful platform for identity and access management, supporting flexible and extensible authentication and authorization workflows. One of its standout features is the ability to customize behavior through scripting, enabling developers and administrators to tailor AM to complex enterprise needs. This practical guide dives into how to customize ForgeRock AM using scripting, with real-world examples and best practices to enhance your IAM deployments. Why Customize ForgeRock AM with Scripts? Extend default authentication logic with custom conditions. Integrate with external systems during login or authorization. Modify tokens, session attributes, or user profiles dynamically. Implement adaptive authentication based on contextual data. Supported Script Types in ForgeRock AM ForgeRock AM supports various script types running on JavaScript, Groovy, or Beanshell: ...

OAuth 2.1 introduces refinements to enhance the security and usability of OAuth flows, especially around refresh tokens. Understanding how refresh tokens work in OAuth 2.1, their lifecycle, and best practices is essential for developers and security architects aiming to build robust authentication systems. What Are Refresh Tokens? Refresh tokens are long-lived credentials issued by the authorization server alongside access tokens. Their purpose is to obtain new access tokens without requiring the user to re-authenticate, enabling seamless user sessions. ...

Token misrouting is a challenging issue that can disrupt authentication and authorization flows in identity platforms like ForgeRock Identity Cloud. It causes users to receive tokens intended for other sessions or clients, leading to security risks and failed user experiences. In this article, we explore a real-world case of token misrouting in ForgeRock Identity Cloud, how we diagnosed the root causes, and the practical steps taken to resolve it effectively. ...

Single Page Applications (SPAs) like React apps face unique challenges when handling OAuth 2.0 flows due to security concerns with exposing tokens in the browser. The Backend-for-Frontend (BFF) pattern provides an elegant solution by shifting sensitive OAuth token handling to a trusted backend while keeping the frontend lightweight. This article walks you through implementing the OAuth 2.0 Authorization Code Flow with PKCE using React as the frontend and a Node.js/Express backend acting as the BFF. ...

Proof Key for Code Exchange (PKCE) has become a standard security enhancement to the OAuth 2.0 Authorization Code Flow—especially in public clients like mobile and single-page applications. But PKCE isn’t just for frontend apps. When combined with a stateless backend built with Kotlin and Spring Boot, it strengthens your security posture, particularly when you’re avoiding client secrets. This guide walks you through how to implement a secure PKCE flow using Kotlin and Spring Boot, including endpoint structure, code challenge generation, and token exchange. ...

When building secure APIs, validating tokens is critical. But not all tokens are self-contained (like JWTs). That’s where OAuth 2.0 Token Introspection comes in — a mechanism to verify token status, scope, and expiration in real time via the authorization server. What Is Token Introspection? Token introspection is defined in RFC 7662. It allows a protected resource (like your API server) to ask the authorization server: “Is this token valid? What does it contain?” ...

OAuth 2.0 is the foundation for modern identity and access management, enabling applications to delegate user authentication securely. In this guide, you’ll learn how to implement the Authorization Code Flow—the most secure OAuth flow for web apps—using Node.js and Express. This is ideal for server-rendered apps or Backend-for-Frontend (BFF) patterns where you control the server exchanging the code for tokens. We’ll walk through everything from route setup to token exchange using only open-source libraries and built-in Express functionality. ...

OAuth 2.0’s Authorization Code Flow is the go-to standard for securing web applications that need to interact with identity providers on behalf of users. In this guide, we’ll walk through how to implement this flow in Java using industry-standard libraries — and explain each step along the way. Why Use the Authorization Code Flow in Java Web Apps? Java remains dominant in enterprise web application development, and OAuth 2.0 is the de facto standard for authorization. When building server-side rendered applications or backend services that interact with identity providers like ForgeRock, Auth0, or Okta, the Authorization Code Flow is the most secure option — especially when combined with HTTPS and secure session management. ...

Access tokens in OAuth 2.0 are short-lived by design. To maintain a seamless user experience without constantly re-authenticating users, OAuth provides a mechanism called refresh tokens. This guide walks you through how refresh tokens work, when to use them, and how to implement access token renewal in a Java backend. What Is a Refresh Token and Why Use It? A refresh token is a special credential issued alongside the access token that allows the client to obtain new access tokens after the old one expires — without involving the user again. ...

OAuth 2.0 helps secure modern applications, but token misuse remains a key security risk. That’s where token revocation comes in. This guide walks you through how OAuth 2.0 token revocation works, when to use it, and how to implement it using real examples — including Java code and ForgeRock configuration insights. Why Token Revocation Matters Access tokens and refresh tokens give clients access to protected resources — but what if: ...