--- title: Gateway guide description: IG integrates web applications, APIs, and microservices with the ForgeRock Identity Platform, without modifying the application or the container where they run. Based on reverse proxy architecture, IG enforces security and access control in conjunction with Access Management modules. component: pinggateway version: 7.2 page_id: pinggateway:gateway-guide:preface canonical_url: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/preface.html llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2025-08-14T11:14:52Z page_aliases: ["index.adoc"] superseded_by: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/preface.html section_ids: preface-examples: Example installation for this guide setup-am: Setting up AM for the examples preface-tools: External tools used in this guide --- # Gateway guide IG integrates web applications, APIs, and microservices with the ForgeRock Identity Platform, without modifying the application or the container where they run. Based on reverse proxy architecture, IG enforces security and access control in conjunction with Access Management modules. This guide is for access management designers and administrators who develop, build, deploy, and maintain IG for their organizations. It helps you to get started quickly, and learn more as you progress through the guide. This guide assumes basic familiarity with the following topics: * Hypertext Transfer Protocol (HTTP), including how clients and servers exchange messages, and the role that a reverse proxy (gateway) plays * JavaScript Object Notation (JSON), which is the format for IG configuration files * Managing services on operating systems and application servers * Configuring network connections on operating systems * Managing Public Key Infrastructure (PKI) used to establish HTTPS connections * Access management for web applications Depending on the features you use, you should also have basic familiarity with the following topics: * Lightweight Directory Access Protocol (LDAP) if you use IG with LDAP directory services * Structured Query Language (SQL) if you use IG with relational databases * Configuring AM if you use password capture and replay, or if you plan to follow the OAuth 2.0 or SAML 2.0 tutorials * The Groovy programming language if you plan to extend IG with scripts * The Java programming language if you plan to extend IG with plugins, and Apache Maven for building plugins ## Example installation for this guide Unless otherwise stated, the examples in this guide assume the following installation: * IG installed on http\://ig.example.com:8080 and https\://ig.example.com:8443, as described in [Downloading, starting, and stopping IG](../getting-started/start-product.html). * Sample application installed on http\://app.example.com:8081, as described in [Using the sample application](../getting-started/start-sampleapp.html). * AM installed on http\://am.example.com:8088/openam, with the default configuration. If you use a different configuration, substitute in the procedures accordingly. ## Setting up AM for the examples This section contains procedures for setting up items in AM that you can use in many of the tutorials in this guide. For more information about setting up AM, see the [Access Management docs](https://docs.pingidentity.com/pingam/7.2). Set up an IG agent in AM In AM 7, follow these steps to set up an agent that acts on behalf of IG in the same domain. In AM 6.5 or earlier, follow the steps in [Set up an IG agent in AM 6.5 and earlier](#setup-agent-65). After the agent is authenticated, the token can be used to get the user profile, evaluate policies, and to connect to the AM notification endpoint: 1. In the AM console, select the top-level realm, and then select Applications > Agents > Identity Gateway. 2. Add an agent with the following values: * Agent ID : `ig_agent` * Password : `password` Set up an IG agent in AM 6.5 and earlier In AM 6.5 and earlier versions, follow these steps to set up an agent that acts on behalf of IG. After the agent is authenticated, the token can be used to get the user profile, evaluate policies, and to connect to the AM notification endpoint: 1. In the AM console, select the top-level realm, and then select Applications > Agents > Java (or J2EE ). 2. Add an agent with the following values: * Agent ID : `ig_agent` for SSO, `ig_agent_cdsso` for CDSSO * Agent URL : `http://ig.example.com:8080/agentapp` for SSO, `http://ig.ext.com:8080/agentapp` for CDSSO * Server URL : `http://openam.example.com:8088/openam` * Password : `password` 3. On the Global tab, deselect Agent Configuration Change Notification. This option stops IG from being notified about agent configuration changes in AM, because they are not required by IG. 4. (For SSO in different domains) On the SSO tab, select the following values: * Cross Domain SSO : Deselect this option * CDSSO Redirect URI : `/home/cdsso/redirect` (To enforce AM policy decisions in different domains) On the SSO tab, select the following values: * Cross Domain SSO : Deselect this option * CDSSO Redirect URI : `/home/pep-cdsso/redirect` Find the name of your AM session cookie The procedures in this guide assume you are using the default AM session cookie, `iPlanetDirectoryPro`. If not, find your session cookie name, and substitute its value in the procedures. 1. In a terminal, access the AM `serverinfo` endpoint to find the session cookie name: ```bash $ curl http://am.example.com:8088/openam/json/serverinfo/* ... "cookieName": "iPlanetDirectoryPro" ``` ## External tools used in this guide The examples in this guide use some of the following third-party tools: * `curl`: * `HTTPie`: * `jq`: * `keytool`: