Catalog / Security & identity

WSO2 Identity Server

Identity and access management with SSO, MFA and identity federation

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace7.3.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
7.3.0$0.028/vCPU/hr
Recommended VM: Standard_D4s_v3
2026-08-07Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamWSO2 LLC
Machine-readableproduct.json · catalog.json
What is WSO2 Identity Server

WSO2 Identity Server is an open-source identity and access management platform that issues and validates tokens for your applications and APIs and centralises how users sign in across them. It runs as a single Java server on Eclipse Temurin 21 and implements OAuth 2.0 and OpenID Connect, SAML 2.0, SCIM 2.0 user provisioning and OIDC front-channel logout, with multi-factor and adaptive authentication, passwordless and social login, B2B organisation management, and self-service registration and password recovery. It federates with external identity providers and can read users from LDAP or Active Directory. This image persists identity, consent, registry and agent data in a bundled PostgreSQL instance, and ships a browser admin console plus a separate My Account portal for end users. Apache-2.0 license, no vendor lock-in. Running your own identity server keeps every login, token and user attribute inside your own AWS account, priced per instance rather than per monthly active user.

What the Lynxroute image adds

Security hardening:

  • No administrator password is baked into the image - a random super-admin credential is generated at first launch and written to a root-only file
  • The signing keystore is regenerated at first launch, replacing the publicly known default key that ships with the distribution, with subject alternative names covering every access path
  • The truststore password is rotated off the published default value
  • The internal application credential that ships with the distribution, and its published hash, are both replaced at first launch
  • Plain HTTP transport is disabled - only the TLS port serves traffic and only that port is opened in the firewall
  • TLS restricted to 1.2 and 1.3; client-initiated TLS renegotiation rejected; the HTTP response header no longer advertises the underlying server stack
  • PostgreSQL bound to 127.0.0.1 only, never exposed off the instance
  • UFW firewall pre-configured - TCP 9443 and SSH 22 only
  • fail2ban and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/wso2is-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer wso2is --plan payg-gen2
az vm create -g my-rg -n wso2is --size Standard_D4s_v3 \
  --image lynxroute:wso2is:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

WSO2 Identity Server 7.3.0 - Initial release (August 2026)

Azure · 2026-08-07
  • WSO2 Identity Server 7.3.0 on Ubuntu 24.04 LTS, Eclipse Temurin 21
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • Production datastore on a bundled local PostgreSQL (identity, shared and agent databases); the embedded H2 development database is not used
  • No administrator password baked into the image - a random super-admin credential is generated at first launch
  • Signing keystore regenerated at first launch, replacing the publicly known default that ships with the distribution; truststore password rotated off its published default
  • Internal application credential and its published hash both replaced at first launch
  • Plain HTTP transport disabled - HTTPS only; TLS restricted to 1.2 and 1.3
  • PostgreSQL bound to localhost
  • UFW firewall pre-configured (22, 9443)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced