Home
Get Started
Guides
Setup
Integrations
APIs
References

7.0.0
6.1.0
6.0.0
Show all

Initializing search

WSO2 Identity Server

Home
Home
Get Started
Get Started
- Introduction
- Quick Setup
- Start integrating apps
  Start integrating apps
  - Try for a sample app
    
    Try for a sample app
    
    Single Page apps
    Single Page apps
    
    React
    
    JavaScript
    
    Web apps
    Web apps
    
    OIDC Java EE
    
    SAML Java EE
    
    WS-Federation
  - Try for your own app
    
    Try for your own app
    
    Single Page apps
    Single Page apps
    
    React
    
    Javascript
    
    Web apps
    Web apps
    
    OIDC Java EE
    
    SAML Java EE
- About this release
Guides
Guides
- Applications
  Applications
- Authentication
  Authentication
  - Add login to apps
    Add login to apps
    
    Add login to apps
    
    Add login to an SPA
    
    Add login to a web app
    
    Add login to a mobile app
  - Add passwordless login
    
    Add passwordless login
    
    Add login with Magic link
    
    Passkeys
    Passkeys
    
    Add login with Passkey
    
    Validate FIDO attestations
    
    Add login with Email OTP
    
    Add login with SMS OTP
  - Add multi-factor authentication
    
    Add multi-factor authentication
    
    Add TOTP
    
    Add Email OTP
    
    Add Passkey
    
    Add SMS OTP
    
    Add user-preferred MFA
    
    Add x509 login
  - Add federated login
    
    Add federated login
    
    Add social login
    
    Add social login
    
    Add Facebook login
    
    Add Google login
    
    Add Github login
    
    Add Microsoft login
    
    Add Apple login
    
    Add X login
    
    Add standard-based login
    
    Add standard-based login
    
    Add login with OIDC IdP
    
    Add login with SAML IdP
    
    Add login with WS-Federation
    
    Add enterprise login
    Add enterprise login
    
    Add IWA login
    
    Add Microsoft 365 login
    
    Configure a custom connector
  - Enable user attributes
    
    Enable user attributes
    
    Enable attributes for OIDC apps
    
    Enable attributes for SAML apps
  - Manage consent for user attributes
  - Configure Just-in-Time user provisioning
  - Add conditional authentication
    
    Add conditional authentication
    
    Set up conditional authentication
    
    Add access control
    Add access control
    
    Add access control
    
    Age-based access
    
    Concurrent session-based access
    
    Add adaptive MFA
    Add adaptive MFA
    
    Add adaptive MFA
    
    MFA based on user role
    
    MFA based on auth context
    
    MFA based on user store
    
    MFA based on login-attempts
    
    MFA based on user group
    
    MFA based on user device
    
    MFA based on IP address
    
    MFA based on ELK-risk
    
    Add passkey progressive enrollment
    
    Write a custom authentication script
  - Configure multi-attribute login
  - Add application-native authentication
  - Configure OIDC flows
    
    Configure OIDC flows
    
    Discover OIDC endpoints
    
    Implement login using the Authorization Code flow
    
    Implement login using the Authorization Code flow and PKCE
    
    Implement private key JWT client authentication for OIDC
    
    Implement login using Pushed Authorization Requests
    
    JWT Secured Authorization Response Mode (JARM) for OAuth 2.0
    
    Configure token exchange
    
    Validate ID tokens
    
    Request user information
    
    Validate tokens
    
    Revoke tokens
    
    Implement logout
  - Configure SAML flows
    
    Configure SAML flows
    
    Discover SAML endpoints and settings
- Authorization
  Authorization
  - API authorization
    API authorization
    
    Role-based access control
    
    Attribute-based access control
  - Fine-grained authorization
    Fine-grained authorization
    
    XACML in provisioning flows
- Branding
  Branding
- User management
  User management
  - Manage administrators
  - Manage users
  - Manage groups
  - Manage roles
  - Manage active sessions
  - Provisioning
    Provisioning
    
    Inbound provisioning
    
    Outbound provisioning
    
    Outbound provisioning
    
    Enable outbound provisioning
    Enable outbound provisioning
    
    Organization-level provisioning
    
    IdP-level provisioning
    
    Role-based provisioning
    
    Configure an outbound connector
    Configure an outbound connector
    
    Google
    
    Salesforce
    
    SCIM2
    
    Provisioning patterns
  - Manage attributes and mappings
    
    Manage attributes and mappings
    
    User attributes
    
    OIDC attribute mappings
    
    OIDC scopes
    
    SCIM2 attribute mappings
    
    Configure email address as the username
    
    Configure unique attributes
  - Manage user stores
    
    Manage user stores
    
    Configure the primary user store
    
    Configure the primary user store
    
    Configure a JDBC user store
    
    Configure a read-only LDAP user store
    
    Configure a read-write Active Directory user store
    
    Configure a read-write LDAP user store
    
    Configure secondary user stores
    
    User store properties
    
    User store properties
    
    Properties used in JDBC user store manager
    
    Properties used in read-only LDAP user store manager
    
    Properties used in read-Write Active Directory user store manager
    
    Properties used in read-write LDAP user store manager
    
    Configure user stores for SCIM 2.0
    
    Configure Active Directory user stores for SCIM 2.0
- Account configurations
  Account configurations
  - Login security
    Login security
    
    Password validation
    
    Login attempts
    
    Bot detection
    
    Session management
  - User Onboarding
    User Onboarding
    
    Self registration
    
    Invite user to set password
  - Account recovery
    Account recovery
    
    Password recovery
    
    Username recovery
    
    Admin Initiated Password Reset
- User self-service
  User self-service
  - Self-service portal
    Self-service portal
    
    User self-service portal
    
    Update profile information
    
    Change password
    
    Manage linked social accounts
    
    Export profile information
    
    Manage consents
    
    Manage login sessions
    
    Self-register
    
    Account confirmation for self-register
    
    Register passkeys
    
    Password recovery
    
    Enroll TOTP
    
    Manage backup codes
    
    Discover applications
  - Build self-service capabilities
- Organizations
  Organizations
- Analytics
  Analytics
- Your WSO2 Identity Server
  Your WSO2 Identity Server
- Multitenancy
  Multitenancy
  - Manage tenants
  - Tenant loading policy
Setup
Setup
- Install
  Install
- Configure
  Configure
  - User Stores
    
    User Stores
    
    Add high availability for LDAP
    
    Secure a JDBC user store with PBKDF2 hashing
    
    Configure the Authorization Manager
    
    Configure the System Administrator
  - Databases
    
    Databases
    
    Change the Carbon Database
    
    Change the Carbon Database
    
    Change to IBM DB2
    
    Change to MariaDB
    
    Change to MSSQL
    
    Change to MySQL
    
    Change to Oracle
    
    Change to Oracle RAC
    
    Change to PostgreSQL
    
    Change to remote H2
    
    Change the Default Datasource for BPS
    
    Change the Default Datasource for Consent Management
    
    Change the Default Datasource for Session Data
    
    Data Dictionary
    Data Dictionary
    
    Registry Related Tables
    
    User Management Related Tables
    
    Identity Related Tables
    
    Service Provider Related Tables
    
    Identity Provider Related Tables
    
    Data Purging
    
    Remove References to Deleted User Identities
  - Session persistence
  - Email sending module
- Secure
  Secure
  - Mitigate attacks
    Mitigate attacks
    
    Cross Site Request Forgery attacks
    
    Authorization Code Interception attacks
    
    Brute Force attacks
    
    Replay attacks
    
    SameSite attribute support
    
    Prevent browser caching
  - Work with tokens
    Work with tokens
    
    Add logs for tokens
    
    Token persistence
    
    Remove unused tokens from the database
    
    Enable assertions in access tokens
  - Enable hostname verification
  - Configure TLS
  - Configure TLS termination
  - Maintain logins and passwords
  - Configure Admin Advisory Banner
  - Secure passwords in configuration files
    Secure passwords in configuration files
    
    Encrypt passwords with Cipher Tool
    
    Resolve encrypted passwords
    
    Customize secure vault
    
    Set passwords using environment variables/system properties
  - Enable HTTP Strict Transport Security (HSTS) headers
  - Enable Java Security Manager
  - Security guidelines
    
    Security guidelines
    
    Product-level
    
    OS-level
    
    Network-level
  - Encryption
    Encryption
    
    Asymmetric encryption
    Asymmetric encryption
    
    Use Asymmetric encryption
    
    Create new keystores
    
    Manage keystores
    
    Renew a CA-Signed certificate in a keystore
    
    Add multiple keys to the primary keystore
    
    Symmetric encryption
    
    Symmetric encryption
    
    Configurations related to symmetric key encryption
    
    Symmetric data encryption key rotation
- Deploy
  Deploy
  - Deployment patterns
  - Deployment checklist
  - WSO2 clusters with Nginx
  - Databases for clustering
  - Change the hostname
  - Enable adaptive authentication
  - Enable FIPS 140-2-compliant mode
  - Configure Hazelcast
  - Backup and recovery recommendations
  - Troubleshoot in production environments
  - Performance
    Performance
    
    Performance tuning recommendations
    
    Configure cache layers
  - Environment compatibility
  - Promote configurations across environments
  - Disaster recovery
    Disaster recovery
    
    Understanding disaster recovery
    
    Deployment patterns
    
    Additional reading
- Compliance
  Compliance
  - GDPR
  - eIDAS
  - CCPA
  - FIPS
  - Accessibility compliance
- Analytics
  Analytics
- Monitor
  Monitor
  - Monitor logs
    Monitor logs
    
    Overview
    
    HTTP access logs
    
    Remote log publishing
    
    Mask sensitive info
    Mask sensitive info
    
    Overview
    
    Log masking with Filebeat
    
    Log masking with Log4j
    
    Log claims in audit logs
  - Monitor server health
  - Work with product observability
- Upgrade WSO2 Identity Server
Integrations
Integrations
APIs
APIs
- System APIs
  System APIs
  - Admin advisory management API
  - Tenant management API
- Management APIs
  Management APIs
  - API resource management
  - Application management
    Application management
    
    Application management API
    
    Authorized apps
    Authorized apps
    
    Authorized apps API V1
    
    Authorized apps API V2
    
    OAuth 2.0 scope management API
    
    OpenID Connect scope management API
    
    OIDC Dynamic Client Registration API
    
    Script Library management API
  - Authentication API
  - Authenticators API
  - Branding Preferences API
  - Claim management API
  - Entitlement management API
  - Extension management API
  - Identity provider API
  - Idle accounts identification API
  - IdP session extension API
  - Notification sender management
    Notification sender management
    
    Notification sender configurations
    
    Notification sender API
  - Organization discovery API
  - Organization discovery configuration management API
  - Organization management API
  - Password expiring users identification API
  - Role management
    Role management
    
    Roles v2 API
    
    Roles v1 API (deprecated)
  - Server management
    Server management
    
    Configuration management
    Configuration management
    
    Configuration management API
    
    Retrieve Tenant Resources Based on Search Parameters
    
    Identity governance
    Identity governance
    
    Identity Governance API introduction
    
    Identity governance API
    
    Keystore management API
    
    User store management API
    
    CORS API
    
    Consent management
    Consent management
    
    Overview
    
    Consent management API
    
    Email templates API
  - Session management API
  - Server configuration API
  - User Functionality management API
  - User management
    User management
    
    SCIM 2.0 API
    SCIM 2.0 API
    
    SCIM 2.0 User management API
    
    SCIM 2.0 Group management API
    
    SCIM 2.0 Patch Operations
    
    SCIM 2.0 Bulk API
    
    SCIM 2.0 Batch Operations
    
    SCIM 2.0 Service provider configuration API
    
    Account recovery APIs
    Account recovery APIs
    
    Account recovery v0.9 API
    
    Account recovery v1 API (deprecated)
    
    Account recovery v2 API
    
    Offline user onboard management API
    
    Self Sign-Up API
    
    User Account Association API
  - Validation rules API
- Organization APIs
  Organization APIs
- End User APIs
  End User APIs
References
References
- About this release
- Feature deprecation
- User management
  User management
- App configurations
  App configurations
- IdP configurations
  IdP configurations
  - OIDC configurations
  - SAML configurations
- Conditional authentication
  Conditional authentication
  - Conditional auth - API
- Authorization policies for apps
- Email templates
- Architecture
- IS extensions
  IS extensions
  - Authentication
    Authentication
    
    OAuth2
    OAuth2
    
    Write a custom OAuth2 grant type
    
    Conditional authentication
    Conditional authentication
    
    Write custom functions for conditional authentication
    
    Write a custom local authenticator
  - Identity Federation
    Identity Federation
    
    Write a custom federated authenticator
  - User Management
    User Management
    
    Write a custom event handler
    
    User provisioning
    User provisioning
    
    Extend SCIM 2.0 user schemas
  - User Stores
    User Stores
    
    Write a custom user store manager
- Default ports
- Troubleshoot
  Troubleshoot
  - Error catalog
  - API error catalog
- Tutorials
  Tutorials
- IAM concepts
  IAM concepts
  - OAuth2 grant types
  - OAuth2 Pushed Authorization Requests
  - Token binding
    
    Token binding
    
    Client-request
  - Financial-grade API
  - Application-native authentication

App configurations

Configure the OpenID connect or SAML protocol related settings of your application in WSO2 Identity Server

Join our Discord

Connect with our community on our official Discord server. Share ideas, get help, and be a part of the awesome conversations!

Join Discord

Got a tough question?Ask on Stackoverflow

Want to contribute?Head over to GitHub

Like to stay updated?Follow us on X (Formerly Twitter)

Prefer video tutorials?Subscribe to our YouTube Channel

© 2024 WSO2 LLC.

Content licensed under CC By 4.0. | Sample code licensed under Apache 2.0.