ForgeRock Production Deployment Checklist
47 battle-tested checkpoints from 100+ enterprise deployments
Pro tip: Check items as you complete them, then print/save as PDF for your records
Phase 1: Planning & Architecture (Pre-Deployment)
PLANNING
Map all authentication scenarios: standard login, MFA, social login, passwordless, account recovery
→ Authentication Journey Design Guide
Calculate TPS requirements, concurrent sessions, storage needs. Plan for 3x peak load capacity.
Define custom attributes, object classes, indexes, and data retention policies
→ LDIF Attribute Mapping Guide
Map source systems, define connectors, reconciliation schedules, and error handling
→ IDM Sync Strategies
List all applications, grant types, redirect URIs, scopes, and token lifetimes
→ Custom OAuth2 Flows
Identify all IdP and SP integrations, certificate management, attribute mapping
→ SAML SSO Implementation
Phase 2: Infrastructure Setup
INFRASTRUCTURE
Minimum 2 DS instances per datacenter. Configure replication, backup, monitoring.
Active Directory, LDAP, database connectors. Test read/write operations.
Production-grade database with failover, connection pooling, and performance tuning
→ MySQL Performance Tuning
Multi-node cluster with persistent storage, ingress, secrets management
→ ForgeOps on OpenShift Guide
AM requires session affinity. Configure health checks on /json/health endpoint.
Ship logs from AM, IDM, DS, IG to central logging platform
→ Audit Logging Best Practices
Phase 3: ForgeRock AM Configuration
ACCESS MANAGEMENT
Create realms for each tenant/environment. Design modular authentication trees.
→ Custom Callbacks Guide
Develop, test, and deploy custom nodes. Version control in Git.
→ AM Script Customization
Token lifetimes, supported grant types, PKCE enforcement, refresh token rotation
→ OAuth2 Deep Dive
Create clients for all applications with appropriate scopes and redirect URIs
Import metadata, configure circles of trust, attribute mapping
→ SAML IDP/SP Configuration
Session timeouts, max concurrent sessions, SSO cookie domain and security flags
Define sensitive operations requiring re-authentication or MFA
Strong passwords, restrict access, enable MFA for privileged accounts
Configure debug.log for troubleshooting. Plan to reduce verbosity post-launch.
→ Debug Logging Techniques
Phase 4: ForgeRock IDM Configuration
IDENTITY MANAGEMENT
HR systems, Active Directory, databases. Test connectivity and error handling.
Bidirectional sync rules, attribute transformations, conflict resolution
→ Resolving Mapping Errors
Full and incremental recon schedules. Monitor for blocked reconciliations.
→ Troubleshooting Blocked Recon
Enable LiveSync on critical connectors for immediate propagation
onUpdate, onCreate scripts for complex business rules
→ IDM Scripting Guide
Sync passwords to downstream systems securely
→ Password Sync Workflow
JsonAuditEventHandler for compliance logging, retention policies
Manager approval for sensitive role assignments, provisioning requests
Phase 5: ForgeRock Identity Gateway (IG)
API GATEWAY
Position IG in front of APIs and legacy apps requiring authentication
→ IG API Security Best Practices
OAuth2ResourceServerFilter, throttling, CORS, header injection
Validate JWT/opaque tokens, transform claims for downstream apps
Prevent abuse, DDoS protection, anomaly detection
Phase 6: Security Hardening
SECURITY
Use trusted CA, wildcard or SAN certs, plan rotation schedule
Never hardcode passwords. Use GenericSecret or external secret managers.
→ Managing Kubernetes Secrets
Disable HTTP. Enforce HSTS headers, secure cookies.
DMZ for external-facing components, internal network for data stores
Whitelist only required ports and IP ranges
X-Frame-Options, X-Content-Type-Options, CSP, X-XSS-Protection
Restrict allowed origins, methods, headers for browser-based apps
Phase 7: Testing & Validation
TESTING
Standard login, MFA, social, passwordless, error scenarios
Authorization code, client credentials, refresh token, token introspection
IdP-initiated, SP-initiated, SLO, attribute assertions
Simulate 3x peak expected load. Monitor CPU, memory, response times.
Create/update/delete users. Confirm propagation to all target systems.
OWASP Top 10, token security, session management, injection attacks
Phase 8: Go-Live & Operations
PRODUCTION
Document common issues, troubleshooting steps, on-call rotation