IAM Deep Dive

20 years of open-source identity management — source code, commit history, CVEs, and protocols. All primary source.

Start with the History Compare Platforms

7Repos Analyzed

58K+Commits Mined

20 yrsTimeline

40+Protocols

30+CVEs Traced

683 pgReference PDF

Six Key Findings

1. The ForgeRock closure (November 2016) was the defining event. It caused a 94% drop in commit velocity within one year — from 6,631 combined commits in 2016 to 401 in 2017. The community split into two forks (OIP and Wren Security) with divergent strategies that persist today.

2. The OIP stack implements more protocols than any single modern alternative. OpenAM alone has 34+ authentication modules, SAML 2.0 IdP/SP, OAuth 2.0/OIDC provider, XACML 3.0 policy engine, UMA 2.0, WS-Federation, and WS-Trust — all in one WAR file. No modern platform matches this breadth.

3. The architecture is a time capsule of 2005–2016 enterprise Java. Monolithic WAR deployment, JAAS authentication chains, OSGi service model (OpenIDM), Jato UI framework (OpenAM), and deep LDAP coupling. Modern IAM has moved to microservices (Ory), event sourcing (Zitadel), API-first design, and cloud-native deployment.

4. Security risk varies dramatically by fork. ForgeRock CE 11.0.3 (frozen since 2017) has 4+ unpatched critical RCE vulnerabilities including CVE-2021-35464 (CVSS 9.8, actively exploited, Metasploit module available). OIP and Wren:AM have patched all critical CVEs.

5. LDAP persists but is being demoted. OpenDJ remains one of the most capable open-source LDAPv3 implementations. But modern platforms use PostgreSQL or CockroachDB as their identity store, with SCIM 2.0 as the wire protocol. LDAP is becoming a compatibility interface.

6. The IAM market has bifurcated into composable services and integrated platforms. The Ory stack (4 independent Go binaries) represents the composable extreme. Keycloak and Zitadel are modern integrated platforms. Auth0/Okta/Cognito are managed SaaS. The OIP stack fits none of these categories.

Choose Your Reading Path

For Leadership (30 min)

For Security Architects (2 hrs)

For Migration Planners (2 hrs)

What’s Here

20-Year History

From Sun OpenSSO (2005) through ForgeRock’s commercial era to today’s two active forks. Interactive commit velocity chart showing the ForgeRock closure cliff.

Protocol Deep Dives

Authentication, federation, authorization, directory services, and token formats — 40+ protocols analyzed across their full lifecycle.

OpenAM Lineage

Deep analysis of all 5 OIP components: OpenAM, OpenDJ, OpenIDM, OpenIG, and OpenICF. Architecture, CVEs, and fork divergence.

Modern Landscape

Where IAM is today: Keycloak, Ory, Auth0, Okta, Cognito, Zitadel, Authentik, and others compared across 8 decision matrices.

Decision Guide

Platform comparison matrices, migration recommendations, and lessons from 20 years of IAM history — the “what should I use?” chapter.

Reference Data

Raw data: complete protocol inventory, CVE history and patch matrix, git commit analysis, and pre-computer authentication history.

Methodology

This research analyzed: 7 Git repositories (full commit history unshallowed — OpenAM, OpenDJ, OpenIDM, OpenIG, OpenICF, ForgeRock CE, Wren:AM) · 683-page ForgeRock OpenAM 12 Reference PDF · CVE databases (NVD, GitHub Security Advisories, git history cross-referenced) · 450+ archived PDFs from PingIdentity/ForgeRock documentation archive · Standards body publications (RFCs, OASIS, W3C, FIDO Alliance, NIST).