Skip to main content

ForgeRock Access Management


Multi-Factor Authentication (MFA) is an extra layer of security used when logging into websites or apps. Individuals are authenticated through more than one required security and validation procedure that only they know or have access to.

RADIUS is a protocol commonly used to authenticate, authorize, and account for user access and actions. Acceptto offers a simple method for adding MFA to ForgeRock Access Management via its Radius solution. This instruction illustrates how to configure ForgeRock OpenAM and Acceptto RADIUS MFA authentication solution.


  1. An Acceptto RADIUS Agent that is configured and connected to the user directory (e.g. Microsoft™ ‘Active Directory™’. See this page for instructions).
  2. A user with administrative privileges for the ForgeRock Access Management admin panel.

Configure the Acceptto RADIUS Agent#

To integrate Acceptto with your ForgeRock AM, you will need to install an Acceptto RADIUS Agent on a machine within your network. This server will receive RADIUS requests from your ForgeRock AM, check with LDAP server to perform primary authentication, and then contact Acceptto cloud service for secondary authentication.

  1. Login to the Acceptto RADIUS Agent with an administrative user and open the radius-agent-config.env file with an editor. It is located in the installed directory of RADIUS Agent. RADIUS clients are configured in this setting.

    Radius setup

  2. Go to the bottom of radius-agent-config.env file and change the ARA_CLIENTS attribute as follows. The values should be separated by semicolons (;).

    ARA_CLIENTS = An optional name for your AM; IP address of your AM; a shared secret

    An example configuration might look like this:

    ARA_CLIENTS = AM;;testing12345

    Radius setup

  3. Save the file and run the following command to set changes:

    docker-compose down && docker-compose up -d

Configure your ForgeRock Access Management#

  1. Login to the ForgeRock AM admin portal with an administrative user.

  2. Select the Realm to set MFA up for.

  3. Navigate to the Authentication section and select Modules.

  4. Click on Add Module to create a new authentication module.

    ForgeRock Modules

  5. Enter a name of your choice and in the Type field. Select RADIUS from the dropdown and click on the Create button.

    ForgeRock new module

  6. On the Servers tab, click ADD.

  7. Enter your Acceptto RADIUS Agent information and click on Save.

Primary Radius ServersIP Address of your Acceptto RADIUS Agent
Shared SecretShared Secret Set in the Acceptto RADIUS Agent
Time90 Seconds (recommended)
Port Number1812
Health check interval5
Authentication Level0

ForgeRock RADIUS setup

  1. On the Authentication section select Settings.

  2. Go to the User Profile tab and select Ignored from User Profile’s drop down menu.

    ForgeRock settings

  3. Click Save Changes.

  4. Now you can change the authentication module on the default chain of your Realm. Navigate to the Authentication section and select Chains. Click on ldapService.

    ForgeRock chains

  5. Click on the edit icon.

    ForgeRock ldapService

  6. In the Select Module field, select the authentication module that was created before from the dropdown and click on Ok button. Click Save Changes.

    ForgeRock edit module

Note: you can check your authentication module with a url that refers to it, like the following example:”enter-authentication-module-name”

Test Your Setup#

  1. Go to the ForgeRock Access Management Realm you created and enter your credentials.

    ForgeRock sign in

  2. You’ll receive a push notification on your It’sMe mobile application. After approving the authentication request through the app, you will be logged in.

    It'sMe notification


If you require assistance, please email us at


Want to learn more about our MFA solutions? Contact our Professional Services for a Demo today.


All product names, trademarks, and registered trademarks are the property of their respective owners.

All company, product, and service names used in this document are for identification purposes only. The use of these names, trademarks, and brands do not constitute an endorsement by the Acceptto Corporation..