All posts

Why This Matters Now: The surge in cryptocurrency theft, reaching US$3.4 billion, has made cybersecurity a top priority. Mexico’s mandate for Zero Trust policies underscores the need for robust identity and access management (IAM) strategies to protect against such threats. As of November 2023, organizations operating in Mexico must comply with these regulations to safeguard their digital assets. 🚨 Breaking: Mexico mandates Zero Trust policies to combat crypto theft worth US$3.4 billion. Ensure your IAM practices align with these new regulations. $3.4B+Crypto Theft Nov 2023Mandate Effective Understanding Zero Trust Zero Trust is a security model that operates on the principle of “never trust, always verify.” Unlike traditional perimeter-based security models that assume all traffic within the network is safe, Zero Trust treats every access request as a potential threat. This approach requires continuous verification of identities and enforcement of the principle of least privilege. ...

Frodo Script Management is a powerful toolset for handling scripts in ForgeRock Access Manager (AM). It allows you to efficiently manage, export, import, and version control scripts, making it easier to maintain and audit your IAM configurations. In this post, we’ll dive into how Frodo Script Management works, how to implement it, and best practices for security and efficiency. What is Frodo Script Management? Frodo Script Management is part of the Frodo CLI, a command-line interface tool designed to simplify the management of ForgeRock Access Manager configurations. Specifically, it provides functionalities for bulk exporting, importing, and version controlling scripts used in AM. This is crucial for maintaining consistency across environments, facilitating backups, and ensuring that script changes are tracked and auditable. ...

Why This Matters Now: The recent surge in phishing attacks targeting Microsoft 365 users has led to numerous account takeovers. Organizations must act swiftly to secure their environments before it’s too late. 🚨 Breaking: Recent phishing campaigns have compromised thousands of Microsoft 365 accounts. Implement robust security measures now to prevent unauthorized access. 3,000+Accounts Compromised 48hrsTo Act Understanding Microsoft 365 Account Takeovers Microsoft 365 account takeovers occur when attackers gain unauthorized access to user accounts through various means such as phishing, brute force attacks, or exploiting vulnerabilities. Once an attacker has control of an account, they can access sensitive data, send malicious emails, install malware, and perform other harmful activities. ...

Why This Matters Now In the world of modern web applications, enabling users to manage their own account details seamlessly is crucial. Traditionally, this required developers to use the Auth0 Management API, which comes with significant administrative power and necessitates server-side handling. This setup often led to added complexity and development overhead, especially for Single Page Applications (SPAs) and mobile apps. The introduction of the Auth0 My Account API addresses these challenges by providing a secure, client-side solution for user self-service management. ...

Frodo CLI is a powerful command-line tool designed to manage ForgeRock Identity Cloud configurations efficiently. It allows you to export and import journeys, policies, and other configurations, making it an essential part of any CI/CD pipeline for Identity Management. In this post, I’ll walk you through setting up Frodo CLI in GitHub Actions to automate the export and import of journeys. What is Frodo CLI? Frodo CLI is a Node.js-based command-line interface that provides a suite of tools for interacting with ForgeRock Identity Cloud. It supports operations such as exporting and importing journeys, managing policies, and handling various configuration tasks. By integrating Frodo CLI into your CI/CD pipeline, you can automate these processes, ensuring consistency and reducing manual errors. ...

Why This Matters Now: In the past few months, there has been a significant increase in OAuth Device Code Phishing attacks targeting Microsoft 365 (M365) accounts. These attacks are particularly dangerous because they exploit the trust users place in legitimate-looking applications, making it easier for attackers to gain unauthorized access to corporate data. The recent rise in such attacks highlights the critical need for robust security measures to safeguard M365 environments. ...

Why This Matters Now The recent surge in identity management challenges has made it crucial for IAM engineers and developers to have robust tools for accessing and managing user data securely. With the increasing sophistication of cyber threats, ensuring that your identity solutions are both efficient and secure is paramount. ForgeRock Access Manager (AM) provides a powerful tool called CoreWrapper that can significantly enhance your ability to manage user information and realm data. This became urgent because many organizations are looking to streamline their IAM processes while maintaining strict security standards. ...

Why This Matters Now GitHub’s OAuth token leak last week exposed over 100,000 repositories, highlighting the risks associated with permanent access tokens. If your startup is still relying on static, long-lived credentials, you’re vulnerable to similar breaches. The urgency to adopt just-in-time (JIT) access controls has never been greater. 🚨 Breaking: Over 100,000 repositories potentially exposed. Check your token rotation policy immediately. 100K+Repos Exposed 72hrsTo Rotate Introduction At our startup, we started with the typical approach—permanent access tokens for services and applications. As we grew, so did the complexity of managing these credentials. We faced numerous challenges, including credential sprawl, increased risk of unauthorized access, and difficulty in auditing and revoking permissions. ...

Identity and Access Management (IAM) certifications validate your expertise and accelerate your career in one of the most critical areas of cybersecurity. This comprehensive guide covers the major IAM certification paths available in 2025. Why Get IAM Certified? Career Impact of IAM Certifications: graph LR subgraph "Career Benefits" A[Certification] --> B[Higher Salary] A --> C[Better Job Opportunities] A --> D[Technical Credibility] A --> E[Vendor Expertise] end style A fill:#667eea,color:#fff Benefit Impact Salary Increase 15-30% higher than non-certified peers Job Opportunities Required for enterprise IAM positions Consulting Rates Premium rates for certified consultants Technical Credibility Validated expertise with customers ForgeRock/Ping Identity Certification Path Following the Ping Identity and ForgeRock merger, the certification ecosystem includes: ...

PingOne Advanced Identity Cloud (formerly ForgeRock Identity Cloud) represents the cloud-native evolution of ForgeRock’s enterprise IAM platform. Following the Ping Identity and ForgeRock merger, this certification validates your expertise in the combined platform. Understanding the Ping-ForgeRock Ecosystem The Merger Context In 2023, Ping Identity acquired ForgeRock, creating a unified identity platform: Product Heritage Current Branding ForgeRock Identity Cloud ForgeRock PingOne Advanced Identity Cloud ForgeRock AM/IDM/DS ForgeRock ForgeRock products under Ping PingOne Ping Identity PingOne (unchanged) PingFederate Ping Identity PingFederate (unchanged) Ping Identity Portfolio Overview: ...

The ForgeRock Certified DS Specialist certification validates your expertise in deploying, configuring, and managing ForgeRock Directory Services. This comprehensive guide covers everything you need to pass the exam. What is ForgeRock Directory Services (DS)? ForgeRock DS is an enterprise-grade, LDAPv3-compliant directory server designed for: Identity Data Storage – Central repository for user identities High Availability – Multi-master replication for fault tolerance Scalability – Millions of entries with sub-millisecond response times Security – TLS encryption, access controls, password policies Integration – Backend for ForgeRock AM and IDM DS Replication Topology: ...

The ForgeRock Certified IDM Specialist certification validates your expertise in implementing and managing ForgeRock Identity Management solutions. This guide provides everything you need to prepare for and pass the exam. What is ForgeRock IDM? ForgeRock Identity Management (IDM) is an enterprise-grade identity governance and provisioning platform that enables: User Lifecycle Management – Joiner, mover, leaver automation Identity Synchronization – Real-time sync between systems Self-Service Capabilities – Password reset, profile management Workflow Orchestration – Approval workflows and business processes Reconciliation – Detecting and resolving identity data discrepancies IDM Core Components: ...

Earning the ForgeRock Certified Access Management Specialist credential demonstrates your expertise in deploying, configuring, and managing ForgeRock Access Management (AM) solutions. This comprehensive guide will help you prepare effectively for the certification exam and boost your career in Identity and Access Management. What is the ForgeRock Certified Access Management Specialist Exam? The ForgeRock Certified Access Management Specialist exam validates your ability to implement and manage ForgeRock AM in enterprise environments. This certification is ideal for: ...

“Should we use Frodo or Amster?” This question comes up in almost every ForgeRock project. The short answer: it depends on your deployment type. The longer answer involves Identity Cloud support, ESV management, and whether you’re willing to deal with Java. Here’s the breakdown to help you decide. The Quick Answer Feature Frodo CLI Amster Platform Support Identity Cloud, ForgeOps, Classic ForgeOps, Classic AM Identity Cloud ✅ Full support ❌ Not supported Installation npm, Homebrew, binary Java-based, bundled with AM Journey Export ✅ With dependencies ✅ Basic export ESV Management ✅ Full support ❌ Not available Script Management ✅ Full support ✅ Full support OAuth2 Management ✅ Full support ✅ Full support Realm Management ✅ Full support ✅ Full support Token Caching ✅ (v2.0+) ✅ Built-in Active Development ✅ Very active ⚠️ Maintenance mode When to Use Frodo ✅ Use Frodo CLI For: 1. PingOne Advanced Identity Cloud (SaaS) ...

Hardcoded API URLs in scripts. Production passwords in environment configs. If you’ve inherited a ForgeRock deployment, you’ve probably seen these anti-patterns. ESVs (Environment Secrets and Variables) are how PingOne Advanced Identity Cloud wants you to handle this—externalize configuration so the same journey works in dev, staging, and prod without code changes. The trick is managing ESVs at scale without losing your mind. Here’s how to do it with Frodo CLI. ...

“Did you remember to export the updated Login journey before leaving on Friday?” This Slack message used to haunt our team. Someone would make changes in dev, forget to export, and by Monday we’d be scratching our heads about what changed. Sound familiar? The fix: wire up Frodo CLI with GitHub Actions and never worry about manual exports again. Here’s exactly how we set it up. Why Bother with CI/CD for ForgeRock? Manual Process CI/CD with Frodo Export from admin console git push triggers export Copy JSON files manually Automated version control Import one-by-one Batch import with validation No audit trail Full Git history Human errors Consistent, repeatable CI/CD Pipeline Flow: ...

If you’ve ever spent an afternoon clicking through the ForgeRock admin console to export journeys one by one, or copy-pasted JSON between browser tabs to migrate configurations—you know the pain. I’ve been there, and it’s exactly why Frodo CLI exists. Frodo (ForgeRock DO) is the CLI that ForgeRock should have shipped from day one. It handles PingOne Advanced Identity Cloud, ForgeOps, and classic AM deployments. Once you start using it, you’ll wonder how you ever lived without it. ...

Decoding JWT tokens can be a crucial part of debugging and understanding the authentication and authorization processes in your applications. Whether you’re working on a microservices architecture or a single-page application, being able to quickly inspect JWT tokens can save you a lot of time. In this post, I’ll walk you through how to decode JWT tokens from the command line using tools like base64 and jq. The Problem JWT tokens are compact, URL-safe means of representing claims to be transferred between two parties. They are commonly used for authentication and information exchange. However, JWT tokens are often encoded, making them unreadable. Decoding them manually can be cumbersome, especially if you need to do it frequently during development or debugging. ...

JWTs (JSON Web Tokens) are a crucial part of modern authentication systems, and choosing the right library to handle them can make a big difference in your project’s security and performance. In this post, we’ll dive into two popular Python libraries for working with JWTs: PyJWT and python-jose. We’ll compare their features, security implications, and use cases to help you decide which one is right for your needs. The Problem: JWT Handling Complexity Handling JWTs involves encoding, decoding, signing, and verifying tokens. Each of these steps can introduce security vulnerabilities if not done correctly. Libraries like PyJWT and python-jose simplify these tasks, but they also come with their own set of trade-offs. Understanding these differences is key to making an informed decision. ...

Setting up an authentication journey in ForgeRock Access Management (AM) can feel overwhelming at first, especially if you’re new to Identity and Access Management (IAM). Trust me, I’ve debugged this 100+ times, and I’m here to save you some time. Let’s dive into creating your first authentication journey, complete with real-world examples and tips. Understanding the Problem Before we start, let’s clarify what we’re trying to achieve. An authentication journey in ForgeRock AM is a series of steps that a user goes through to prove their identity. This could involve entering a username and password, answering security questions, or using multi-factor authentication (MFA). ...