ForgeRock
Connect ForgeRock to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect ForgeRock to collect identity & sso evidence with automated compliance tests, switched on per workspace.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
Connect with an API token
-
In ForgeRock:
- In the Advanced Identity Cloud (ForgeRock Identity Cloud) admin console, open the TENANT menu (upper right) and click Tenant settings.
- Click Global Settings › Service Accounts, then click New Service Account.
- Enter a name and optional description, and under Scopes select only fr:idm:* (the scope for the /openidm/* identity APIs Safeguard reads).
- Click Save, then click Download Key to download the service account private key. It will not be available again.
- Create a JWT signed with that private key and exchange it for an access token using the JWT profile for OAuth 2.0 authorization grant flow, requesting the same scopes (or a subset). Paste the access token into Safeguard.
Where to find the other values:
- Base URL (optional): Your tenant environment's FQDN, https://<tenant-env-fqdn>. Ping says to request the access token on the tenant FQDN, not an Alpha or Bravo realm alias URL or a custom domain URL.
ForgeRock shows the secret only once, so copy it before you leave the page.
ForgeRock issues this credential through its API or its support team, not through its admin screens.
Source: docs.pingidentity.com, backstage.forgerock.com, checked 2026-10-07.
-
On Compliance › Connectors, open ForgeRock, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read ForgeRock and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks