{
 "slug": "wso2is",
 "name": "WSO2 Identity Server",
 "tagline": "Identity and access management with SSO, MFA and identity federation",
 "category": "security-identity",
 "use_cases": [
  "sso",
  "identity-provider",
  "federation"
 ],
 "aliases": [
  "wso2 identity server"
 ],
 "status": "live",
 "upstream": {
  "vendor": "WSO2 LLC",
  "url": "https://wso2.com/identity-server/",
  "license": "Apache-2.0",
  "license_url": "https://github.com/wso2/product-is/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   9443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "7.3.0",
   "last_build": "2026-08-07",
   "offer_id": "wso2is",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:wso2is:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.wso2is?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/wso2is/",
  "json": "https://lynxroute.com/products/wso2is/product.json"
 },
 "release_notes": [
  {
   "version": "7.3.0",
   "title": "WSO2 Identity Server 7.3.0 - Initial release (August 2026)",
   "notes": "* WSO2 Identity Server 7.3.0 on Ubuntu 24.04 LTS, Eclipse Temurin 21\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Production datastore on a bundled local PostgreSQL (identity, shared and agent databases); the embedded H2 development database is not used\n* No administrator password baked into the image - a random super-admin credential is generated at first launch\n* Signing keystore regenerated at first launch, replacing the publicly known default that ships with the distribution; truststore password rotated off its published default\n* Internal application credential and its published hash both replaced at first launch\n* Plain HTTP transport disabled - HTTPS only; TLS restricted to 1.2 and 1.3\n* PostgreSQL bound to localhost\n* UFW firewall pre-configured (22, 9443)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-07"
   }
  }
 ],
 "release_history": [
  {
   "version": "7.3.0",
   "azure": "2026-08-07"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer wso2is --plan payg-gen2\naz vm create -g my-rg -n wso2is --size Standard_D4s_v3 \\\n  --image lynxroute:wso2is:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "WSO2 Identity Server is an open-source identity and access management platform that issues and validates tokens for your applications and APIs and centralises how users sign in across them. It runs as a single Java server on Eclipse Temurin 21 and implements OAuth 2.0 and OpenID Connect, SAML 2.0, SCIM 2.0 user provisioning and OIDC front-channel logout, with multi-factor and adaptive authentication, passwordless and social login, B2B organisation management, and self-service registration and password recovery. It federates with external identity providers and can read users from LDAP or Active Directory. This image persists identity, consent, registry and agent data in a bundled PostgreSQL instance, and ships a browser admin console plus a separate My Account portal for end users. Apache-2.0 license, no vendor lock-in. Running your own identity server keeps every login, token and user attribute inside your own AWS account, priced per instance rather than per monthly active user.",
  "image_adds": "Security hardening:\n* No administrator password is baked into the image - a random super-admin credential is generated at first launch and written to a root-only file\n* The signing keystore is regenerated at first launch, replacing the publicly known default key that ships with the distribution, with subject alternative names covering every access path\n* The truststore password is rotated off the published default value\n* The internal application credential that ships with the distribution, and its published hash, are both replaced at first launch\n* Plain HTTP transport is disabled - only the TLS port serves traffic and only that port is opened in the firewall\n* TLS restricted to 1.2 and 1.3; client-initiated TLS renegotiation rejected; the HTTP response header no longer advertises the underlying server stack\n* PostgreSQL bound to 127.0.0.1 only, never exposed off the instance\n* UFW firewall pre-configured - TCP 9443 and SSH 22 only\n* fail2ban and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}