WSO2 Identity Server is an open-source identity and access management platform for Java-based on-premises and cloud deployments, aimed at teams that need to secure applications, APIs, workforce, consumer, and business-customer logins under standards such as OAuth 2.0, OIDC, and SAML 2.0.

What it is

WSO2 Identity Server is an identity and access management (IAM) product whose source code lives in the product-is repository, written in Java under the Apache 2.0 licence. It is positioned as a modern IAM solution that can be run on-premises or in a cloud environment, covering external consumers, internal workforce, business customers, and API access from a single identity foundation. It also backs the hosted identity cloud offering Asgardeo, which the project describes as built on the same technology core.

The concrete problem it addresses is the fragmentation of authentication and authorization across many application types and user populations. By consolidating adaptive authentication, single sign-on, multi-factor authentication, OAuth 2.0/OIDC, SAML 2.0, and RBAC-based API authorization into one server, it replaces the need to assemble and maintain separate components for each protocol and each audience, while still allowing an organisation to choose where the software is deployed.

Key capabilities

• A visual designer for building authentication flows, with templates that simplify configuring applications and authentication methods.
• Natural-language input that automatically generates complex login flows, together with assisted brand matching that generates the corresponding UX components.
• Simplified use of RBAC to define fine-grained API access policies, plus an authentication API intended for in-app authentication.
• B2B CIAM features including advanced RBAC for delegated administration rights, per-customer login options that can include an enterprise IdP, per-customer customizable branding, and support for organization hierarchies such as B2B2C.
• API security built on the FAPI standard, layered on top of the OAuth 2.0 standard and originating in financial services.
• Standards coverage across OAuth2, OIDC, SAML2, single sign-on, multi-factor and adaptive authentication, and authorization.
• An all-new administrative console that is shared with Asgardeo and Private Identity Cloud.

Who uses it and how

• Organisations securing external consumer applications alongside internal workforce applications on the same server.
• Business-to-business teams onboarding customer organizations, using delegated administration and per-customer branding for B2B2C hierarchies.
• API teams applying fine-grained RBAC policies and FAPI-based protections to programmatic access.
• Deployments that need the freedom to run the software on-premises rather than committing to a hosted identity provider.
• Developers who use the visual designer and authentication API while building login experiences into their applications.

Getting started

The code is published as the product-is repository on GitHub, where the README points to guidance on working with the repository and contributing code, and where the master branch build status and test results are tracked on the project's Jenkins instance.

How it compares

This registry entry stands alone: the facts provided name no comparable alternative tools for it to be measured against.

When to use it — and when not

It suits teams that want to operate their own identity layer rather than depend on a hosted provider, and for whom standards breadth and deploy-anywhere freedom matter. Organisations that would rather not run an identity server at all can use the hosted Asgardeo option instead, and prospective users should note the repository currently carries 1,632 open issues, which suggests a substantial and actively triaged backlog when evaluating support expectations.

- New visual designer that simplifies development of authentication flows. 
- New templates to easily configure apps and authentication methods. 
- Simplified use of RBAC to define fine-grained API access policies. 
- New authentication API for in-app authentication, further streamlining user access. 

- Natural language for login flow requirements to automatically generate complex authentication flows. 
- Assisted brand matching to automatically generate all UX components

- Advanced RBAC to define delegated administration rights.
- Choice of login options per customer, including enterprise IDP. 
- Subscription model to ensure the right apps are available to customers.
- Customizable branding per customer to ensure the highest user engagement.
- Rich support for various organization hierarchies, such as B2B2C. 

- Additional security features built on top of the OAuth2 standard.
- Originating in financial services, but now desired by many industries. 

- All-new administrative console.
- Shared with [Asgardeo](https://wso2.com/asgardeo/) and Private Identity Cloud.