logo logo
  • Home
  • Get Started
  • Guides
  • Setup
  • Integrations
  • APIs
  • References
7.0.0
  • 7.0.0
  • 6.1.0
  • 6.0.0
  • Show all
Initializing search
    • Home
      • Introduction
      • Quick Setup
      • Start integrating apps
        • Try for a sample app
            • React
            • JavaScript
            • OIDC Java EE
            • SAML Java EE
            • WS-Federation
        • Try for your own app
            • React
            • Javascript
            • OIDC Java EE
            • SAML Java EE
      • About this release
    • Guides
      • Applications
        • Register an SPA
        • Register web app with OIDC
        • Register web app with SAML
        • Register a standard-based app
        • Register a mobile app
        • Register a machine-to-machine (M2M) app
        • Register a FAPI-compliant app
      • Authentication
          • Add login to apps
          • Add login to an SPA
          • Add login to a web app
          • Add login to a mobile app
        • Add passwordless login
          • Add login with Magic link
            • Add login with Passkey
            • Validate FIDO attestations
          • Add login with Email OTP
          • Add login with SMS OTP
        • Add multi-factor authentication
          • Add TOTP
          • Add Email OTP
          • Add Passkey
          • Add SMS OTP
          • Add user-preferred MFA
          • Add x509 login
        • Add federated login
          • Add social login
            • Add Facebook login
            • Add Google login
            • Add Github login
            • Add Microsoft login
            • Add Apple login
            • Add X login
          • Add standard-based login
            • Add login with OIDC IdP
            • Add login with SAML IdP
            • Add login with WS-Federation
            • Add IWA login
            • Add Microsoft 365 login
          • Configure a custom connector
        • Enable user attributes
          • Enable attributes for OIDC apps
          • Enable attributes for SAML apps
        • Manage consent for user attributes
        • Configure Just-in-Time user provisioning
        • Add conditional authentication
          • Set up conditional authentication
            • Add access control
            • Age-based access
            • Concurrent session-based access
            • Add adaptive MFA
            • MFA based on user role
            • MFA based on auth context
            • MFA based on user store
            • MFA based on login-attempts
            • MFA based on user group
            • MFA based on user device
            • MFA based on IP address
            • MFA based on ELK-risk
            • MFA based on TypingDNA
          • Add passkey progressive enrollment
          • Write a custom authentication script
        • Configure multi-attribute login
        • App-native authentication
          • Add app-native authentication
          • Secure app-native authentication flows
          • Handle advanced login scenarios
        • Configure OIDC flows
          • Discover OIDC endpoints
          • Implement login using the Authorization Code flow
          • Implement login using the Authorization Code flow and PKCE
          • Implement private key JWT client authentication for OIDC
          • Implement login using Pushed Authorization Requests
          • Implement login using the Device Authorization flow
          • JWT Secured Authorization Response Mode (JARM) for OAuth 2.0
          • Implement login using the OIDC Hybrid Flow
          • Configure token exchange
          • Validate ID tokens
          • Request user information
          • Validate tokens
          • Revoke tokens
          • Implement logout
          • Implement back channel logout
          • Implement federated IdP-initiated logout
        • Configure SAML flows
          • Discover SAML endpoints and settings
      • Authorization
          • Role-based access control
          • Attribute-based access control
          • XACML in provisioning flows
          • User Impersonation
      • Branding
        • Configure UI branding
        • Customize layouts
        • Customize email templates
        • Localization support
      • User management
        • Manage administrators
        • Manage users
        • Manage groups
        • Manage roles
        • Manage active sessions
          • Inbound provisioning
          • Outbound provisioning
              • Organization-level provisioning
              • IdP-level provisioning
            • Role-based provisioning
              • Google
              • Salesforce
              • SCIM2
            • Provisioning patterns
          • Overview
          • Hubspot
          • Salesforce
          • Pipedrive CRM
          • Sendgrid
          • Zoho CRM
        • Manage attributes and mappings
          • User attributes
          • OIDC attribute mappings
          • OIDC scopes
          • SCIM2 attribute mappings
          • Configure email address as the username
          • Configure unique attributes
          • Configure user attribute change verification
        • Manage user stores
          • Configure the primary user store
            • Configure a JDBC user store
            • Configure a read-only LDAP user store
            • Configure a read-write Active Directory user store
            • Configure a read-write LDAP user store
          • Configure secondary user stores
          • User store properties
            • Properties used in JDBC user store manager
            • Properties used in read-only LDAP user store manager
            • Properties used in read-Write Active Directory user store manager
            • Properties used in read-write LDAP user store manager
          • Configure user stores for SCIM 2.0
          • Configure Active Directory user stores for SCIM 2.0
      • Account configurations
          • Password validation
          • Login attempts
          • Bot detection
          • Session management
          • Self registration
          • Invite user to set password
          • Password recovery
          • Username recovery
          • Admin Initiated Password Reset
      • User self-service
          • Configure the self-service portal
          • Update profile information
          • Change password
          • Manage linked social accounts
          • Export profile information
          • Manage consents
          • Manage login sessions
          • Self-register
          • Account confirmation for self-register
          • Register passkeys
          • Password recovery
          • Enroll TOTP
          • Manage backup codes
          • Discover applications
        • Build self-service capabilities
      • Organizations
        • Set up organizations
        • Administration of organizations
        • Share applications
        • Onboard organization admins
          • Sales-led approach
          • Self-service approach
        • Invite users from parent organization
        • Try a B2B use case
        • API authorization for organizations
        • Email domain based organization discovery
        • ELK Analytics
          • Access analytics
          • Analyze login attempts
          • Analyze active sessions
          • ELK Alerts
        • Web analytic solutions
        • A/B Testing
      • Your WSO2 Identity Server
        • Manage Console access
        • Self-service
        • Recover your password
      • Multitenancy
        • Manage tenants
        • Tenant loading policy
        • Install
        • Run
        • Get WSO2 updates
        • User Stores
          • Add high availability for LDAP
          • Secure a JDBC user store with PBKDF2 hashing
          • Configure the Authorization Manager
          • Configure the System Administrator
        • Databases
          • Change the Carbon Database
            • Change to IBM DB2
            • Change to MariaDB
            • Change to MSSQL
            • Change to MySQL
            • Change to Oracle
            • Change to Oracle RAC
            • Change to PostgreSQL
            • Change to remote H2
            • Change the Default Datasource for BPS
            • Change the Default Datasource for Consent Management
            • Change the Default Datasource for Session Data
          • Data Purging
          • Remove References to Deleted User Identities
        • Session persistence
        • Email sending module
          • Cross Site Request Forgery attacks
          • Authorization Code Interception attacks
          • Brute Force attacks
          • Replay attacks
          • SameSite attribute support
          • Prevent browser caching
          • Add logs for tokens
          • Token persistence
          • Remove unused tokens from the database
          • Enable assertions in access tokens
        • Enable hostname verification
          • Configure TLS
          • Configure TLS termination
          • Configure post-quantum TLS
        • Maintain logins and passwords
        • Configure Admin Advisory Banner
          • Encrypt passwords with Cipher Tool
          • Resolve encrypted passwords
          • Customize secure vault
          • Set passwords using environment variables/system properties
        • Enable HTTP Strict Transport Security (HSTS) headers
        • Enable Java Security Manager
        • Enable FIPS 140-2-compliant mode
        • Security guidelines
          • Product-level
          • OS-level
          • Network-level
          • Symmetric encryption
            • Configure symmetric key encryption
            • Symmetric data encryption key rotation
          • Asymmetric encryption
          • Keystores
            • Create new keystores
            • Manage keystores
            • Manage CA-Signed certificates in a keystore
        • Deployment patterns
        • Deployment checklist
        • WSO2 clusters with Nginx
        • Databases for clustering
        • Change the hostname
        • Enable adaptive authentication
        • Configure Hazelcast
        • Backup and recovery recommendations
        • Troubleshoot in production environments
          • Performance tuning recommendations
          • Configure cache layers
        • Environment compatibility
        • Promote configurations across environments
          • Understanding disaster recovery
          • Deployment patterns
          • Additional reading
      • Compliance
        • GDPR
        • eIDAS
        • CCPA
        • FIPS
        • Accessibility compliance
        • Configure ELK analytics
        • Configure SSO with ELK analytics
        • Configure ELK alerts
        • Configure ELK analytics for adaptive authentication
      • Monitor
          • Overview
          • HTTP access logs
          • Remote log publishing
            • Overview
            • Log masking with Filebeat
            • Log masking with Log4j
          • Log claims in audit logs
        • Monitor server health
        • Work with product observability
      • Upgrade WSO2 Identity Server
    • Integrations
    • APIs
        • Admin advisory management API
        • Tenant management API
        • API resource management
          • Application management API
            • Authorized apps API V1
            • Authorized apps API V2
          • OAuth 2.0 scope management API
          • OpenID Connect scope management API
          • OIDC Dynamic Client Registration API
          • Script Library management API
        • App-native authentication API
        • Authentication Data API
        • Authenticators API
        • Branding Preferences API
        • Claim management API
        • Entitlement management API
        • Extension management API
        • Identity provider API
        • Idle accounts identification API
        • IdP session extension API
          • Notification sender configurations
          • Notification sender API
        • Organization discovery API
        • Organization discovery configuration management API
        • Organization management API
        • Password expiring users identification API
          • Roles v2 API
          • Roles v1 API (deprecated)
            • Configuration management API
            • Retrieve Tenant Resources Based on Search Parameters
            • Identity Governance API introduction
            • Identity governance API
          • Keystore management API
          • User store management API
          • CORS API
            • Overview
            • Consent management API
            • Email templates v1 API
            • Email templates v2 API
        • Session management API
        • Server configuration API
        • User Functionality management API
          • SCIM 2.0 API
            • SCIM 2.0 Users API
            • SCIM 2.0 Groups API
            • SCIM 2.0 Patch operations
            • SCIM 2.0 Bulk API
            • SCIM 2.0 Batch operations
            • SCIM 2.0 Resource types API
            • SCIM 2.0 Service provider configuration API
            • Account recovery v0.9 API
            • Account recovery v1 API (deprecated)
            • Account recovery v2 API
          • Offline user onboard management API
          • Self Sign-Up API
          • User Account Association API
        • Validation rules API
      • Organization APIs
        • Get access for organization APIs
        • Application management API
        • Authenticators API
        • Branding management API
        • Claim management API
        • Identity provider management API
        • Identity recovery API
        • Idle accounts identification API
        • Invite parent organization's users API
        • Offline user onboard management API
        • Organization discovery API
        • Organization management API
        • Password expiring users identification API
        • SCIM 2.0 Role management API
        • User management
          • SCIM 2.0 Users API
          • SCIM 2.0 Groups API
          • SCIM 2.0 Bulk API
        • FIDO API
        • Session management API
        • SCIM 2.0 Me API
        • TOTP API
        • User account association API
        • User discoverable application API
    • References
      • About this release
      • Feature deprecation
        • User roles
        • Track user deletion
        • Self registration confirmation
      • App configurations
        • OIDC configurations
        • SAML configurations
        • WS-Federation configurations
      • IdP configurations
        • OIDC configurations
        • SAML configurations
        • Conditional auth - API
      • Authorization policies for apps
      • Email templates
      • Architecture
      • IS extensions
            • Write a custom OAuth2 grant type
            • Write custom functions for conditional authentication
          • Write a custom local authenticator
          • Write a custom federated authenticator
          • Write a custom event handler
            • Extend SCIM 2.0 user schemas
          • Write a custom user store manager
      • Default ports
      • Troubleshoot
        • Error catalog
        • API error catalog
        • App-native error catalog
        • Verifiable credentials with Microsoft Entra Verified ID
        • Verifiable credentials with MATTR
        • Send notifications through an external scheduled task
        • OAuth2 grant types
        • OAuth2 Pushed Authorization Requests
        • Token binding
          • Client-request
        • Financial-grade API
        • App-native authentication
        • OIDC session management

    Back to top

    Join our Discord

    Connect with our community on our official Discord server. Share ideas, get help, and be a part of the awesome conversations!

    Join Discord
    Ask on Stackoverflow
    Head over to GitHub
    Follow us on X (Formerly Twitter)
    Subscribe to our YouTube Channel
    © 2024 WSO2 LLC.
    Content licensed under CC By 4.0. | Sample code licensed under Apache 2.0.