OpenAM
| Company type | Open-source software project |
|---|---|
| Industry | Identity management, Access management |
| Predecessor | OpenSSO by Sun Microsystems |
| Founded | July 2005 |
| Founder | Sun Microsystems |
Area served | Worldwide |
| Products | Access management, entitlement control, federation services |
| Owner | Open Identity Platform Community |
OpenAM is an open-source platform dedicated to access management, entitlement control, and federation services, currently maintained by the Open Identity Platform Community.
Originally developed as OpenSSO (Open Single Sign-On) by Sun Microsystems and subsequently acquired by Oracle Corporation, OpenAM was created as a fork following Oracle’s purchase of Sun Microsystems.
History
OpenSSO was first unveiled by Sun Microsystems in July 2005, built upon the foundation of the Sun Java System Access Manager, and served as the primary component of Sun’s commercial access management and federation solution, known as OpenSSO Enterprise.
In July 2008, Sun began offering paid support for the periodic "Express" releases of OpenSSO, which were issued roughly every quarter to provide early access to new features. By September 2008, Sun had introduced OpenSSO Enterprise 8.0, the initial commercial product derived from this project, with an official launch in November 2008. This product earned recognition by winning the "Security" category in Developer.com’s Product of the Year awards for 2009.
After Oracle acquired Sun Microsystems in early 2010, it ceased further development and distribution of OpenSSO. This led ForgeRock to fork the project under the name OpenAM, continuing its enhancement and support while Oracle retained ownership of the OpenSSO brand. ForgeRock aligned its efforts with Sun’s original development roadmap and maintained stewardship of OpenAM until 2016.
In November 2016, ForgeRock transitioned OpenAM into a closed-source model, rebranding it as ForgeRock Access Management and shifting distribution toward a commercial licensing model.
Currently, various open-source forks persist under the Common Development and Distribution License:
- The Open Identity Platform Community, which continues to develop under the OpenAM Community designation.
- The Wren Security community, which renamed their fork "Wren:AM" to distinguish it from ForgeRock’s proprietary offering.
Features
OpenAM delivers an extensive range of capabilities designed for enterprise-scale identity and access management:
- Authentication
- Supports more than twenty built-in authentication methods with options to chain multiple methods, implement Multi-factor authentication, or create custom modules leveraging the JAAS (Java Authentication and Authorization Service) framework. It also includes Integrated Windows Authentication support for seamless single sign-on across diverse operating systems and web platforms.
- Authorization
- Enables policy definitions from straightforward coarse-grained rules to sophisticated fine-grained entitlements utilizing XACML (eXtensible Access Control Markup Language). These policies are decoupled from application code, allowing rapid updates without modifying underlying software.
- Adaptive risk authentication
- Assesses authentication risk dynamically by scoring factors such as IP address ranges, unfamiliar devices, or session inactivity to determine if additional verification steps are necessary—balancing security with user experience.
- Federation
- Facilitates secure identity exchange across different systems and domains using protocols like SAML, WS-Federation, and OpenID Connect. Features include Fedlet, OAuth2 Client/Provider support, and the OpenIG Federation Gateway—a SAML2-compliant enforcement point that integrates federation capabilities without requiring changes or plugins in applications. Prebuilt integrations exist for platforms such as G Suite and ADFS2. Additionally, OpenAM serves as a multiprotocol hub capable of translating legacy standards while supporting OAuth2 for modern token-based authorization.
- Single sign-on (SSO)
- Provides diverse SSO solutions suitable for cross-domain or multi-organization environments through its Federation Service. Enforcement can be managed via agents installed on web/application servers or proxy servers, or through the standalone OpenIG Identity Gateway—ideal when agent deployment is impractical.
- High availability
- Engineered for critical environments with features such as system failover and session failover to avoid any single point of failure. Redundancy is achieved through multiple servers, policy agents, and load balancers ensuring continuous operation and uninterrupted user sessions.
- Developer interfaces
- Offers Java and C client APIs along with a RESTful API delivering JSON or XML over HTTP. This facilitates integration of authentication, authorization, and identity management services into web applications using REST clients across various programming languages. Support for OAuth2 extends these functionalities with a contemporary REST interface supporting federation and authorization protocols.