ForgeRock Access Management alternative for Oracle and legacy web apps

SSOGEN is a ForgeRock Access Management alternative built for the web tier that AM web agents often guard: Oracle E-Business Suite, PeopleSoft, JD Edwards and older in-house applications. The SSOGEN Web Agent runs inside Apache and Oracle HTTP Server, and the identity provider, MFA, Gateway and AI agent controls ship as one product.

Request a Quote

Integration tab of a Web Agent application in the SSOGEN Admin Console after the agent key was copied.

The SSOGEN Admin Console: one Web Agent application, its agent key copied once for the web server team.

ForgeRock Access Management (AM) is now PingAM, part of Ping Identity since the two companies joined on August 23, 2023. If your AM web agents protect Oracle applications or older web apps, the SSOGEN Web Agent and SSOGEN cover the same jobs at the web server and behind it, without code changes to the application.

What changed at ForgeRock

Then	Now, in Ping’s own words
ForgeRock, an independent company	“Ping and ForgeRock joined together on August 23, 2023” (Ping press release, November 2023)
ForgeRock Access Management	PingAM, “a centralized access management server” for authentication, authorization, web security and federation
ForgeRock web agents	Web Agent, “a PingAM or Advanced Identity Cloud add-on component that operates as a Policy Enforcement Point”
ForgeRock Identity Cloud	PingOne Advanced Identity Cloud
ForgeRock Identity Gateway	PingGateway, listed by Ping for “long-term unification” with PingAccess
ForgeRock Identity Platform	Ping Advanced Identity Software

The PingAM release notes date these names to early 2024. Ping also states that it will “support, develop, and invest in all core Ping Identity and ForgeRock platforms”, so nobody is forced to move. Teams look at an alternative when an AM upgrade, a renewal or a new Oracle project is due anyway.

Agent to agent

AM and SSOGEN share a shape at the web server: a module checks the session and passes the user to the application. The differences sit in where the module runs and what stands behind it.

	PingAM (formerly ForgeRock AM)	SSOGEN
Web servers for the agent	Web Agent 2026.6: Apache HTTP Server 2.4, Red Hat JBoss Core Services, IBM HTTP Server 8.5 and 9, NGINX Plus, Microsoft IIS 10 and ISAPI	The Web Agent runs in Apache 2.4, Apache 2.2 and Oracle HTTP Server
Oracle E-Business Suite, PeopleSoft, JD Edwards	Oracle HTTP Server is not in the Web Agent requirements we read	One integration package per product installs the module on the Oracle HTTP Server web tier and writes its configuration with one command
Java applications	Not covered by this comparison	The Java agent for Tomcat 9, 10.1 and 11 and Spring Boot 3.5
Apps with no agent	PingGateway, planned for unification with PingAccess	The Gateway App Proxy, which can also fill a login form or use Kerberos constrained delegation
The server behind the agent	PingAM, or PingOne Advanced Identity Cloud	SSOGEN on your own Enterprise Linux servers with PostgreSQL, or an organization hosted by SSOGEN
Access decisions	AM resource-based policies, enforced by the agent	A named sign-in policy per application, with step-up and a What if screen that names the policy and each reason
AI agents	Not covered by this comparison	An owned identity per agent, key-bound tokens and the MCP Gateway, in the same console

Ping facts come from the PingAM documentation, the Web Agent requirements page and Ping’s ForgeRock pages, read 2026-11-15. Check them against the version you run.

Moving from AM, one application at a time

Inventory the agents
List each AM web agent, the web server it runs in, the protected paths, and the user attributes each application reads.
Register the application in SSOGEN
Create a Web Agent application, generate its agent key and assign the people or groups who use it.
Install on the web tier
For E-Business Suite, PeopleSoft or JD Edwards, run the SSOGEN package with its check option first. For other apps, paste the generated configuration block into Apache or Oracle HTTP Server.
Pilot on the new path
Test with a few users on the new path while AM serves everyone else. The wizard’s Test step shows what the application receives.
Complete the application
Move the remaining users. That application is complete; repeat for the next one.

What to plan for

Policies are re-created. There is no AM policy importer. Access rules become sign-in policies and group assignments, a design step SSOGEN does with you.
Attribute names matter. Check which user attribute each application reads from AM, and map it in the application’s settings before cut-over.
E-Business Suite needs more than a paste. The package runs as the applications owner, updates the EBS sign-in profile options and deploys the AccessGate application. The migration playbooks cover each Oracle product.
People stay where they are. Active Directory or LDAP stays the source of users. During the move, AM can be the sign-in source through SAML or OpenID Connect.

Questions people ask

What is ForgeRock access management?

ForgeRock Access Management is an access management server for authentication, authorization, web security and federation. Ping Identity now ships it as PingAM. Web agents installed in Apache, IIS, NGINX Plus or IBM HTTP Server enforce its policies at each protected application, and PingOne Advanced Identity Cloud offers the same functions as a service.

Does ForgeRock still exist?

ForgeRock still exists as a set of products inside Ping Identity, not as a separate company. Ping states that it will support, develop and invest in all core Ping Identity and ForgeRock platforms. ForgeRock Access Management continues as PingAM, and ForgeRock Identity Cloud is being renamed PingOne Advanced Identity Cloud.

Was ForgeRock acquired by Ping Identity?

Yes. Thoma Bravo agreed to acquire ForgeRock in October 2022, and Ping and ForgeRock joined together on August 23, 2023, according to Ping’s own press release. Since early 2024, ForgeRock products carry Ping names: PingAM, PingIDM, PingDS, PingGateway and PingOne Advanced Identity Cloud.

Is ForgeRock an IAM?

Yes. ForgeRock products cover identity and access management: access management (now PingAM), identity management (now PingIDM), a directory (now PingDS) and an identity gateway (now PingGateway). SSOGEN is also an IAM product: a complete identity provider with MFA, a Web Agent, a Gateway and identity for AI agents.

Where to go next

All comparisons. The SSO comparison hub lists every product SSOGEN is compared with.
Ping today. Ping Identity vs SSOGEN covers PingOne, PingFederate and PingAccess.
Legacy access managers. Migrate from legacy access managers sets out the order of a move.

Sources, all read 2026-11-15: Ping and ForgeRock join forces; Ping Identity press release, November 21, 2023; ForgeRock to be acquired by Thoma Bravo; PingAM 8 documentation; PingAM release notes, name changes; About Web Agent; Web Agent requirements.

ForgeRock, PingAM, PingIDM, PingDS, PingGateway, PingAccess, PingOne and Ping Identity are trademarks of Ping Identity Corporation. Oracle, E-Business Suite, PeopleSoft and JD Edwards are trademarks of Oracle and its affiliates. SSOGEN is an Oracle partner, but Oracle has not reviewed or endorsed this page. Microsoft, IIS, IBM, NGINX and Red Hat are trademarks of their owners. SSOGEN is not affiliated with Ping Identity. Competitor details are from their public pages and may change; check them for your own version.