ForgeRock

ForgeRock
Name	ForgeRock
Type	Private
Industry	Identity and Access Management
Founded	2010
Founder	Françoise Brunet, Victor Leikehman, Jonathan Neal, David H. Lai
Headquarters	San Francisco, California, United States
Key people	Fran Rosso (CEO)
Products	Identity Platform, Access Management, Identity Governance, Directory Services, Identity Gateway

ForgeRock ForgeRock is an identity and access management vendor that provides software for secure digital identity lifecycle management across enterprise, cloud, and consumer environments. The company offers products for authentication, authorization, directory services, governance, and privacy that serve sectors including finance, healthcare, telecommunications, and government. ForgeRock's platform competes with vendors in the identity and access management space and is used by organizations transitioning to cloud-native and zero trust architectures.

History

Founded in 2010 by former engineers and executives with backgrounds at companies such as Sun Microsystems, Oracle Corporation, Red Hat, IBM, and Microsoft, the company emerged to commercialize open-source projects and enterprise identity solutions. Early milestones included contributions to the OpenDJ and OpenAM codebases and partnerships with service providers tied to projects like Apache Software Foundation initiatives. The company expanded internationally with offices in regions populated by technology hubs including Silicon Valley, London, Frankfurt, Singapore, and Sydney. ForgeRock pursued venture funding rounds involving investors associated with firms similar to Accel Partners, Kleiner Perkins, Khosla Ventures, and later prepared for public offering activities paralleling peers such as Okta and Ping Identity. Strategic acquisitions and hiring bolstered capabilities amid market shifts driven by regulatory regimes like the General Data Protection Regulation and standards bodies such as the OpenID Foundation and Fast Identity Online Alliance.

Products and Technology

ForgeRock's portfolio centers on a modular identity platform offering components for access management, identity management, directory services, governance, and edge identity. Key product types resemble offerings from SailPoint Technologies, CyberArk, Auth0, Ping Identity, and Microsoft Azure Active Directory. The platform supports protocols and standards including OAuth 2.0, OpenID Connect, SAML 2.0, SCIM, and integration points with LDAP directories common in deployments tied to Salesforce, Workday, ServiceNow, and SAP. Features include adaptive authentication, multi-factor authentication workflows comparable to those by Duo Security and Yubico, consent management aligned with ePrivacy Directive expectations, and APIs used in microservices patterns championed by Docker and Kubernetes ecosystems.

Architecture and Components

The architecture is built on modular services and microservices principles influenced by cloud-native patterns promoted by Cloud Native Computing Foundation projects. Core components include an access management server that handles authentication and authorization flows, an identity management engine for provisioning and lifecycle tasks, a high-performance directory server for identity data storage, and an identity gateway for perimeter and API protection. The directory component interoperates with protocol implementations found in OpenLDAP and enterprise directories deployed by Oracle Directory Server and IBM Security Directory Server. The platform supports persistence backends such as MySQL, PostgreSQL, and enterprise databases used by Oracle Corporation and Microsoft SQL Server, and it leverages caching and messaging layers similar to Redis and Apache Kafka to scale in large deployments.

Security and Compliance

Security features emphasize standards compliance, encryption, credential management, and auditing aligned with frameworks from National Institute of Standards and Technology, ISO/IEC 27001, and sectoral regulations such as Health Insurance Portability and Accountability Act and Payment Card Industry Data Security Standard. The product implements fine-grained authorization controls using model concepts akin to XACML and integrates with identity proofing and risk assessment providers used by banks and telecoms. Role-based access control and privileged access management integrations mirror approaches taken by Centrify and BeyondTrust, while logging and SIEM compatibility support solutions from Splunk and Elastic NV for compliance reporting.

Deployment and Integration

Deployments span on-premises, private cloud, and public cloud environments including Amazon Web Services, Microsoft Azure, and Google Cloud Platform. The platform provides containerized distributions suitable for orchestration on Kubernetes and integrates with CI/CD toolchains using systems like Jenkins, GitLab, and Ansible. Identity federation use cases connect with entity providers in federations such as eduGAIN and enterprise single sign-on solutions from Okta and OneLogin. Enterprises often combine the platform with customer relationship systems like Oracle Customer Experience Cloud and billing platforms in the telecommunications sector similar to implementations by Ericsson and Nokia.

Market Position and Customers

ForgeRock competes in the identity and access management market alongside vendors including Okta, Ping Identity, SailPoint Technologies, and CyberArk. The customer base spans telecom carriers, financial institutions, government agencies, and large enterprises, with deployments reported in organizations comparable to Telefonica, Deutsche Telekom, Barclays, and national identity programs seen in countries that have adopted digital identity strategies similar to Estonia. The company positions itself for digital transformation initiatives, customer identity and access management, and workforce identity consolidation in sectors driven by digital services from firms like Amazon and Alibaba Group.

Controversies and Incidents

Controversies in the identity sector commonly involve privacy, data breaches, and vendor practices; incidents affecting identity providers have led to scrutiny from regulators such as European Data Protection Board and national data protection authorities like Information Commissioner's Office in the United Kingdom. Security researchers and auditors from organizations akin to OWASP and independent firms have periodically disclosed vulnerabilities and recommended patches and configuration changes for identity platforms. Supply chain and open-source licensing discussions intersect with corporate stewardship debates similar to those experienced by Red Hat and Canonical.

Category:Identity management companies