Skip to content

Home
Get Started
Guides
Setup
Integrations
APIs
References

7.0.0
6.1.0
6.0.0
Show all

Initializing search

WSO2 Identity Server

Home
Home
Get Started
Get Started
- Introduction
- Quick Setup
- Start integrating apps
  Start integrating apps
  - Try for a sample app
    
    Try for a sample app
    
    Single Page apps
    Single Page apps
    
    React
    
    JavaScript
    
    Web apps
    Web apps
    
    OIDC Java EE
    
    SAML Java EE
    
    WS-Federation
  - Try for your own app
    
    Try for your own app
    
    Single Page apps
    Single Page apps
    
    React
    
    Javascript
    
    Web apps
    Web apps
    
    OIDC Java EE
    
    SAML Java EE
- About this release
Guides
Guides
- Applications
  Applications
- Authentication
  Authentication
  - Add login to apps
    Add login to apps
    
    Add login to apps
    
    Add login to an SPA
    
    Add login to a web app
    
    Add login to a mobile app
  - Add passwordless login
    
    Add passwordless login
    
    Add login with Magic link
    
    Passkeys
    Passkeys
    
    Add login with Passkey
    
    Validate FIDO attestations
    
    Add login with Email OTP
    
    Add login with SMS OTP
  - Add multi-factor authentication
    
    Add multi-factor authentication
    
    Add TOTP
    
    Add Email OTP
    
    Add Passkey
    
    Add SMS OTP
    
    Add user-preferred MFA
    
    Add x509 login
  - Add federated login
    
    Add federated login
    
    Add social login
    
    Add social login
    
    Add Facebook login
    
    Add Google login
    
    Add Github login
    
    Add Microsoft login
    
    Add Apple login
    
    Add X login
    
    Add standard-based login
    
    Add standard-based login
    
    Add login with OIDC IdP
    
    Add login with SAML IdP
    
    Add login with WS-Federation
    
    Add enterprise login
    Add enterprise login
    
    Add IWA login
    
    Add Microsoft 365 login
    
    Configure a custom connector
  - Enable user attributes
    
    Enable user attributes
    
    Enable attributes for OIDC apps
    
    Enable attributes for SAML apps
  - Manage consent for user attributes
  - Configure Just-in-Time user provisioning
  - Add conditional authentication
    
    Add conditional authentication
    
    Set up conditional authentication
    
    Add access control
    Add access control
    
    Add access control
    
    Age-based access
    
    Concurrent session-based access
    
    Add adaptive MFA
    Add adaptive MFA
    
    Add adaptive MFA
    
    MFA based on user role
    
    MFA based on auth context
    
    MFA based on user store
    
    MFA based on login-attempts
    
    MFA based on user group
    
    MFA based on user device
    
    MFA based on IP address
    
    MFA based on ELK-risk
    
    MFA based on TypingDNA
    
    Add passkey progressive enrollment
    
    Write a custom authentication script
  - Configure multi-attribute login
  - App-native authentication
    
    App-native authentication
    
    Add app-native authentication
    
    Secure app-native authentication flows
    
    Handle advanced login scenarios
  - Configure OIDC flows
    
    Configure OIDC flows
    
    Discover OIDC endpoints
    
    Implement login using the Authorization Code flow
    
    Implement login using the Authorization Code flow and PKCE
    
    Implement private key JWT client authentication for OIDC
    
    Implement login using Pushed Authorization Requests
    
    Implement login using the Device Authorization flow
    
    JWT Secured Authorization Response Mode (JARM) for OAuth 2.0
    
    Implement login using the OIDC Hybrid Flow
    
    Configure token exchange
    
    Validate ID tokens
    
    Request user information
    
    Validate tokens
    
    Revoke tokens
    
    Implement logout
    
    Implement back channel logout
    
    Implement federated IdP-initiated logout
  - Configure SAML flows
    
    Configure SAML flows
    
    Discover SAML endpoints and settings
- Authorization
  Authorization
  - API authorization
    API authorization
    
    Role-based access control
    
    Attribute-based access control
  - Fine-grained authorization
    Fine-grained authorization
    
    XACML in provisioning flows
  - User Impersonation
- Branding
  Branding
- User management
  User management
  - Manage administrators
  - Manage users
  - Manage groups
  - Manage roles
  - Manage active sessions
  - Provisioning
    Provisioning
    
    Inbound provisioning
    
    Outbound provisioning
    
    Outbound provisioning
    
    Enable outbound provisioning
    Enable outbound provisioning
    
    Organization-level provisioning
    
    IdP-level provisioning
    
    Role-based provisioning
    
    Configure an outbound connector
    Configure an outbound connector
    
    Google
    
    Salesforce
    
    SCIM2
    
    Custom Outbound Connector
    
    Provisioning patterns
  - Sync User Accounts
    Sync User Accounts
    
    Overview
    
    Hubspot
    
    Salesforce
    
    Pipedrive CRM
    
    Sendgrid
    
    Zoho CRM
  - Manage attributes and mappings
    
    Manage attributes and mappings
    
    User attributes
    
    OIDC attribute mappings
    
    OIDC scopes
    
    SCIM2 attribute mappings
    
    Configure email address as the username
    
    Configure unique attributes
    
    Configure user attribute change verification
  - Manage user stores
    
    Manage user stores
    
    Configure the primary user store
    
    Configure the primary user store
    
    Configure a JDBC user store
    
    Configure a read-only LDAP user store
    
    Configure a read-write Active Directory user store
    
    Configure a read-write LDAP user store
    
    Configure secondary user stores
    
    User store properties
    
    User store properties
    
    Properties used in JDBC user store manager
    
    Properties used in read-only LDAP user store manager
    
    Properties used in read-Write Active Directory user store manager
    
    Properties used in read-write LDAP user store manager
    
    Configure user stores for SCIM 2.0
    
    Configure Active Directory user stores for SCIM 2.0
- Account configurations
  Account configurations
  - Login security
    Login security
    
    Password validation
    
    Login attempts
    
    Bot detection
    
    Session management
  - User Onboarding
    User Onboarding
    
    Self registration
    
    Invite user to set password
  - Account recovery
    Account recovery
    
    Password recovery
    
    Username recovery
    
    Admin Initiated Password Reset
- User self-service
  User self-service
  - Self-service portal
    Self-service portal
    
    Configure the self-service portal
    
    Update profile information
    
    Change password
    
    Manage linked social accounts
    
    Export profile information
    
    Manage consents
    
    Manage login sessions
    
    Self-register
    
    Account confirmation for self-register
    
    Register passkeys
    
    Password recovery
    
    Enroll TOTP
    
    Manage backup codes
    
    Discover applications
  - Build self-service capabilities
- Organizations
  Organizations
  - Set up organizations
  - Administration of organizations
  - Share applications
  - Onboard organization admins
    
    Onboard organization admins
    
    Sales-led approach
    
    Self-service approach
  - Invite users from parent organization
  - Try a B2B use case
  - API authorization for organizations
  - Email domain based organization discovery
- Analytics
  Analytics
  - ELK Analytics
    
    ELK Analytics
    
    Access analytics
    
    Analyze login attempts
    
    Analyze active sessions
    
    ELK Alerts
  - Web analytic solutions
  - A/B Testing
- Your WSO2 Identity Server
  Your WSO2 Identity Server
- Multitenancy
  Multitenancy
  - Manage tenants
  - Tenant loading policy
Setup
Setup
- Install
  Install
- Configure
  Configure
- Secure
  Secure
  - Mitigate attacks
    Mitigate attacks
    
    Cross Site Request Forgery attacks
    
    Authorization Code Interception attacks
    
    Brute Force attacks
    
    Replay attacks
    
    SameSite attribute support
    
    Prevent browser caching
  - Work with tokens
    Work with tokens
    
    Add logs for tokens
    
    Token persistence
    
    Remove unused tokens from the database
    
    Enable assertions in access tokens
  - Enable hostname verification
  - Transport Level Security
    Transport Level Security
    
    Configure TLS
    
    Configure TLS termination
    
    Configure post-quantum TLS
  - Maintain logins and passwords
  - Configure Admin Advisory Banner
  - Secure passwords in configuration files
    Secure passwords in configuration files
    
    Encrypt passwords with Cipher Tool
    
    Resolve encrypted passwords
    
    Customize secure vault
    
    Set passwords using environment variables/system properties
  - Enable HTTP Strict Transport Security (HSTS) headers
  - Enable Java Security Manager
  - Enable FIPS 140-2-compliant mode
  - Security guidelines
    
    Security guidelines
    
    Product-level
    
    OS-level
    
    Network-level
  - Encryption
    Encryption
    
    Symmetric encryption
    
    Symmetric encryption
    
    Symmetric data encryption key rotation
    
    Asymmetric encryption
    
    Asymmetric encryption
    
    Keystores
    
    Keystores
    
    Create new keystores
    
    Manage keystores
    
    Manage CA-Signed certificates in a keystore
- Deploy
  Deploy
  - Deployment patterns
  - Deployment checklist
  - WSO2 clusters with Nginx
  - Databases for clustering
  - Change the hostname
  - Enable adaptive authentication
  - Configure Hazelcast
  - Backup and recovery recommendations
  - Troubleshoot in production environments
  - Performance
    Performance
    
    Performance tuning recommendations
    
    Configure cache layers
  - Environment compatibility
  - Promote configurations across environments
  - Disaster recovery
    Disaster recovery
    
    Understanding disaster recovery
    
    Deployment patterns
    
    Additional reading
- Compliance
  Compliance
  - GDPR
  - eIDAS
  - CCPA
  - FIPS
  - Accessibility compliance
- Analytics
  Analytics
- Monitor
  Monitor
  - Monitor logs
    Monitor logs
    
    Overview
    
    HTTP access logs
    
    Remote log publishing
    
    Mask sensitive info
    Mask sensitive info
    
    Overview
    
    Log masking with Filebeat
    
    Log masking with Log4j
    
    Log claims in audit logs
  - Monitor server health
  - Work with product observability
- Upgrade WSO2 Identity Server
Integrations
Integrations
APIs
APIs
- System APIs
  System APIs
  - Admin advisory management API
  - Tenant management API
- Management APIs
  Management APIs
  - API resource management
  - Application management
    Application management
    
    Application management API
    
    Authorized apps
    Authorized apps
    
    Authorized apps API V1
    
    Authorized apps API V2
    
    OAuth 2.0 scope management API
    
    OpenID Connect scope management API
    
    OIDC Dynamic Client Registration API
    
    Script Library management API
  - App-native authentication API
  - Authentication Data API
  - Authenticators API
  - Branding Preferences API
  - Claim management API
  - Entitlement management API
  - Extension management API
  - Identity provider API
  - Idle accounts identification API
  - IdP session extension API
  - Notification sender management
    Notification sender management
    
    Notification sender configurations
    
    Notification sender API
  - Organization discovery API
  - Organization discovery configuration management API
  - Organization management API
  - Password expiring users identification API
  - Role management
    Role management
    
    Roles v2 API
    
    Roles v1 API (deprecated)
  - Server management
    Server management
    
    Configuration management
    Configuration management
    
    Configuration management API
    
    Retrieve Tenant Resources Based on Search Parameters
    
    Identity governance
    Identity governance
    
    Identity Governance API introduction
    
    Identity governance API
    
    Keystore management API
    
    User store management API
    
    CORS API
    
    Consent management
    Consent management
    
    Overview
    
    Consent management API
    
    Email templates
    Email templates
    
    Email templates v1 API
    
    Email templates v2 API
  - Session management API
  - Server configuration API
  - User Functionality management API
  - User management
    User management
    
    SCIM 2.0 API
    
    SCIM 2.0 API
    
    SCIM 2.0 Users API
    
    SCIM 2.0 Groups API
    
    SCIM 2.0 Patch operations
    
    SCIM 2.0 Bulk API
    
    SCIM 2.0 Batch operations
    
    SCIM 2.0 Resource types API
    
    SCIM 2.0 Service provider configuration API
    
    Additional resources
    Additional resources
    
    Build SCIM 2.0 user creation payload
    
    Account recovery APIs
    Account recovery APIs
    
    Account recovery v0.9 API
    
    Account recovery v1 API (deprecated)
    
    Account recovery v2 API
    
    Offline user onboard management API
    
    Self Sign-Up API
    
    User Account Association API
  - Validation rules API
- Organization APIs
  Organization APIs
- End User APIs
  End User APIs
References
References
- About this release
- Feature deprecation
- User management
  User management
- App configurations
  App configurations
- IdP configurations
  IdP configurations
  - OIDC configurations
  - SAML configurations
- Conditional authentication
  Conditional authentication
  - Conditional auth - API
- Authorization policies for apps
- Email templates
- Architecture
- IS extensions
  IS extensions
  - Authentication
    Authentication
    
    OAuth2
    OAuth2
    
    Write a custom OAuth2 grant type
    
    Conditional authentication
    Conditional authentication
    
    Write custom functions for conditional authentication
    
    Customize the authentication endpoint
    
    Write a custom local authenticator
  - Identity Federation
    Identity Federation
    
    Write a custom federated authenticator
  - User Management
    User Management
    
    Write a custom event handler
    
    User provisioning
    User provisioning
    
    Extend SCIM 2.0 user schemas
  - User Stores
    User Stores
    
    Write a custom user store manager
- Default ports
- Troubleshoot
  Troubleshoot
- Tutorials
  Tutorials
- IAM concepts
  IAM concepts
  - OAuth2 grant types
  - OAuth2 Pushed Authorization Requests
  - Token binding
    
    Token binding
    
    Client-request
  - Financial-grade API
  - App-native authentication
  - OIDC session management
React Guide
React Guide
Quick Starts
Quick Starts
- React Quickstart
- Angular Quickstart

Extensions¶

This section discuss how WSO2 Identity Server can be extended related to following aspects.

Authentication
Identity Federation
User Management
User Stores

Join our Discord

Connect with our community on our official Discord server. Share ideas, get help, and be a part of the awesome conversations!

Join Discord

Got a tough question?Ask on Stackoverflow

Want to contribute?Head over to GitHub

Like to stay updated?Follow us on X (Formerly Twitter)

Prefer video tutorials?Subscribe to our YouTube Channel

© 2024-2025 WSO2 LLC.

Content licensed under CC By 4.0. | Sample code licensed under Apache 2.0.