Configuring ForgeRock Identity Cloud as a SAML 2.0 Provider

ForgeRock Identity Cloud Provides the full power of ForgeRocks Identity Platform as a service. Most of the configuration described is relevant for an on-prem deployment of Access Management (AM), however our focus here will be Identity Cloud.

Identity Gateway (IG ) can act in numerous personas while protecting API’s, microservices, modern, as well as legacy applications. IG has even been referred to as ForgeRock’s Swiss Army Knife due to its highly configurable nature to meet even the most complex use cases.

While this article combines both of these requirements, they can be met individually and you can plug in both your own SP or IDP should that be required.

The following terms are used in SAML and federation:

Log in to your Identity Cloud Console and browse to Identities → Manage → Alpha realm — Users then click +New Alpha realm — User.

We will create a simple user as follows:

Once created let’s set a few of Identity Cloud’s additional static attributes we want available to our client application.

In this example you will need to refer to`fr-attr-istr1` and fr-attr-istr2 in order to retrieve the values set for Generic Indexed String 1 and`Generic Indexed String 2` respectively.

Now the user is configured let’s check we can login by authenticating to the Alpha realm.

Login to Identity Cloud as a tenant administrator and browse to Native Consoles → Access Management.

In the AM console, browse to Applications → Federation → Circles of Trust.

Choose a name that suits, in our example we have decided on Circle of Trust which has been configured in the above fedlet configuration files. Enter the name and press Create. Leave all other fields as default.

The service provider details have already been configured in the above sp.xml. This will be imported into Identity Cloud as a Remote Service Provider.


Browse to Applications → Federation → Entity providers → Add Entity Provider and select Remote.

The following steps will configure Identity Cloud as the Hosted Identity Provider. Browse to Applications → Federation → Entity Providers → Add Entity Provider → Hosted.

Enter openam as the Entity ID and idp as the Identity Provider Meta Alias , and select the correct Circles of Trust , then press Create.

SAML Attribute = cn, Local Attribute = cn


press Add

Do the same thing with sn and mail i.e.

SAML Attribute = sn, Local Attribute = sn

SAML Attribute = mail, Local Attribute = mail

Also let’s add our additional attributes. To show there are many ways to achieve this we will map each one based on different requirements.

To achieve this, map the following attributes:

SAML Attribute = mystring, Local Attribute = fr-att-istr1

SAML Attribute = fr-att-istr2, Local Attribute = fr-att-istr2

After this is completed your Attribute Map will look like this:

Now press Save Changes .

You will need to export the IDP settings and provide them to the Service Provider.


Execute the following curl command to export the IDP settings:

$ tree -l conf/
conf/
├── FederationConfig.properties
├── fedlet.cot
├── idp-extended.xml
├── idp.xml
├── sp-extended.xml
└── sp.xml

In the IG folder, create a directory named SAML at the same level as the config folder (Not IN the config folder). Move all the files into this SAML folder i.e.

A copy of all relevant files can be found here.

If you have a config.json file setup, remove the baseURI. This is an important step because the SamlFederationHandler must not be rebased.

Add a route to pass through css and other resources for your sample application. To do this create a file named static-resources.json with the content below and place this into your routes folder i.e.

Add a saml route to configure the SamlFederationHandler by creating a file named saml.json and placing it in the routes folder i.e.

In this route we map the values returned in the assertion to be stored in IG’s session context, i.e. cn from the assertion will be mapped to session.username. The handler redirects the traffic back to the federate route on completion. More information about the SamlFederationHandler can be found here and here.

Add a federate route to direct traffic to the SP initiated SSO endpoint. To do this create a file name`federate.json` as follows:

If no session is detected, this route will direct traffic to the saml federation handler route and once established will pull values from the session context and add them as headers in the request to the backend application.


Notice that when the HeaderFilter adds headers to the request they are easily reference by the attribute name in the session context i.e. ${session.username[0]}, however fr-att-istr2 needs to be referenced differently because it contains the dash character i.e.${session[‘fr-attr-istr2’][0]}.


The setup should now be complete and is now ready to test!