Again, my main criticism of Gluu is lack of a transparent security record (I posted a bit more on this lower down in this thread).
4 karma · joined September 21, 2014
If we take their statement at face value, then we'd have to make the following assumptions for this to make sense:
1. They have an upcoming coordinated release of at least two products, but likely all of the products (otherwise, it would only make sense to have cut off access for the products that are about to ship).
2. There must be some new feature(s), which have not yet been merged into the master branches, planned for the new versions that they want to keep under wraps so they can announce them and disrupt the market for a short time (or else there's no advantage to closing off access because anyone mirroring already has snapshots of the upcoming release).
Even with these assumptions, its a bit weak. If they're releasing something as-of-yet unseen in the new release, they will still have to release the source code to whatever that is when they publicly post the new version, so if "staying ahead of the joneses" (i.e. competition) is the main driver it's probably only a 6 month lead, at best.
A suicidal move for them would be to pull even the major releases from public release. In my experience setting up, customizing, and deploying the ForgeRock suite, I can say that there are enough moving parts that a prospective client needs to be able to play with it for a bit and see if it's a fit in the client's environment. Despite what others may have written elsewhere on the net, I'm not saying anything is incomplete or that the design is counter-intuitive -- after coming up the learning curve on some foundational concepts, the way they've laid it all out makes sense. It's just that, their sales cycle would be a nightmare if they can't actually put something in the prospect's hands without inking an agreement. Let alone the fact that any binary trial version is still subject to CDDL licensing requirements for the source code.
My immediate question after this statement was posted was to ask if this lack of access is expected to continue even after the release. You can follow the thread here: https://forgerock.org/topic/where-has-the-trunk-gone/
Their response was a second non-answer along the lines of "I'm sure there will be a statement at that time".
They don't even make a list of their most prominent customers public on their site.
Keycloak, on the other hand, is supported by RedHat, so any advisories relating to it come out through their normal advisory system. A user considering Keycloak or OpenAM is in a much better spot to make an informed decision about security than one considering Gluu, for these reasons.
"We apologise for any inconvenience our recent changes may have caused. We are preparing for the next major release of the ForgeRock Identity Platform and as part of this process, we are no longer providing public access to our nightly builds and source code for the upcoming platform release. Open source downloads are still available via https://backstage.forgerock.com/downloads."