This page is about the ForgeRock packages available to purchase. Data is from the slides they shared with us extended with email communication.

Text with red colour: Vacuumlabs explanation of what is needed and what is not and why.

Executive Summary

FR Package	Proposal
Core	YES
Access Plus	YES
Identity Plus	NO
Edge	Only Microservices Capabilities
Sync	NO
Autonomous Access	probably (not really a technical dependency, more based on business / risk needs)
Cloud Support Services	This is a business decision (Platinum?)
Cloud Onboarding Services	If this is not a recurring cost but a single payment for onboarding (and not astronomical), we may want to go with FLEX. Can we select some items from FLEX or do we have to buy the whole package?

Identity Cloud

Package Structure

Core

TL;DR: proposal: we do need this package

We need this package since this is the Core.

Access Plus

TL;DR: proposal: we do need this package

We need (at least) these features from the package:

WebAuthN passwordless authentication (if we plan to use public key infrastructure)
Transactional Authorization
Most probably we will need Token transformation & Exchange

Identity Plus

TL;DR: proposal: we do NOT need this package

Delegated Administration Features

Feature	Description	Documentation Links
Managed Organizations	Organizations let you give users fine-grained administrative privileges to users based on hierarchical groups.	Managed Organizations
Delegated Administration	Grant role-based, limited access to perform fine-grained administrative tasks on managed objects.	Privileges and Delegation to Restrict Administrative Access

Managed Organizations link is inaccessible.

We do not need Delegated Administration since we do not plan to use IDM’s user management functions. User management will not be in IDM.

User Privacy and Consent Capabilities

Feature	Description	Documentation Links
Profile and Privacy Management Dashboard	Dashboard for managing personal user information.	Privacy: My Account Information in the End User UI
Consent and Preference Management	Configurable user preferences.	Configure Privacy and Consent

We do not plan to use the End User UI, all user related configuration will be in the mobile app or via backoffice systems.

We do not want to configure consent for self-registration or social registration. Consent (T&C, etc) management is handled by other systems.

Social Identity Capabilities

Registration	User registration with social identity accounts.	Social Registration
Attribute Scope Management	Administrators can include any or all scopes available, by social identity provider.	Social Registration

We do not plan to use social identities.

Edge

TL;DR: proposal: we only need Microservices Security from this package

Identity Gateway Capabilities

Feature	Description	Documentation Links
Studio	User interface for rapid development and prototyping.	About Identity Gateway Studio User Guide
Single Sign-On	Single sign-on in a single domain and across domains.	Single Sign-On and Cross-Domain Single Sign-On
Password Replay	Secure replay of credentials to legacy applications or APIs.	Getting Login Credentials From Data Sources Getting Login Credentials From AM
Policy Enforcement	Enforcement of centralized authorization policies for applications requiring Access Management.	Enforcing Policy Decisions From AM Hardening Authorization With Advice From AM
Federation	OpenID Connect 1.0.	Acting As an OpenID Connect Relying Party
	OAuth 2.0.	Acting As an OAuth 2.0 Resource Server
	SAML 2.0.	Acting As a SAML 2.0 Service Provider
	SAML resources for mobile applications.	Transforming OpenID Connect ID Tokens Into SAML Assertions
Finance APIs	Support for OAuth 2.0 Mutual TLS and Financial-Grade APIs.	Validating Certificate-Bound Access Tokens FapiInteractionIdFilter
WebSocket Protocol	Detection of requests to upgrade from HTTPS to the WebSocket protocol, and creation of a secure, dedicated tunnel to send and receive WebSocket traffic.	Proxying WebSocket Traffic
Throttling	Throttling to limit access to protected applications.	Throttling the Rate of Requests to Protected Applications

Our APIs use our own API gateway and since the API will be developed from scratch, we do not need IG’s password replay, policy enforcement, or other features targeted for legacy applications. For now, we do not need federation capabilities either.

Microservices Capabilities

Microgateway	Sidecar-type, container-optimized gateway for securing microservices.	About Microgateway
Token Validation Microservice	Platform satellite for introspection of stateful and stateless OAuth 2.0 access tokens.	About the Token Validation Microservice

These are the parts that we most probably need except if we implement our own solution.