DOCSEARCHbyAlgolia
Submit Docs

WSO2 Identity Server Documentation

repository·master·Indexed 21 days ago

https://github.com/wso2/product-is

A modern identity and access management (IAM) solution for on-premises or cloud environments. It supports securing applications for external consumers, internal workforces, and API access using standards like OAuth2 and FAPI. The documentation covers API implementation and deployment, OIDC and FAPI conformance testing via GitHub Actions or local scripts, and administrative scenarios for managing users and roles using SCIM 2.0, SCIM 1.1, and SOAP services.

Tokens
19.4K
Snippets
51
Records
105
Agent score
74%

What's inside WSO2 Identity Server

  1. Access Delegation Scenarios in WSO2 Identity Server

    master

    WSO2 Identity Server supports various access delegation patterns to allow third-party applications or users to delegate access to resources. This scenario covers two primary sub-scenarios:

    1. Access Delegation with End-user Authorization: A pattern where an end-user explicitly authorizes an application to access their resources.
    2. Access Delegation with User-managed Access (UMA): A pattern based on the User-Managed Access specification, allowing users to manage access to their resources through a centralized policy engine.

  3. Single Sign On (SSO) and Federated Authentication for Web Applications

    master

    This scenario covers implementing Single Sign On (SSO) and Federated Authentication for web applications using WSO2 Identity Server. It provides guidance for developers to enable users to access multiple web applications using a single set of credentials through various industry-standard protocols.

    Available sub-scenarios include:

    • SSO with SAML Protocol: Implementing authentication using the Security Assertion Markup Language.
    • SAML eIDAS support: Utilizing SAML for electronic identification, authentication, and trust services.
    • SAML 2.0 artifact binding support: Using the SAML artifact binding mechanism for secure token exchange.
    • SSO with OIDC Protocol: Implementing authentication using OpenID Connect.
    • SSO with WS-Fed Protocol: Implementing authentication using Web Services Federation.
    • Single sign-on for web applications using multiple protocols: Configuring cross-protocol SSO capabilities.
    • Single sign on with end user consent: Implementing flows that require explicit user consent during the authentication process.

  4. Explore Single Sign-On (SSO) and Identity Federation scenarios

    master

    This scenario guide provides implementation patterns for achieving Single Sign-On (SSO) and Identity Federation using WSO2 Identity Server. It covers various authentication flows, ranging from standard protocol-based logins to social authenticator integration and Just-In-Time (JIT) user provisioning.

    Available sub-scenarios include:

    • Login with standard protocols: Implementing authentication using established industry protocols.
    • Login with social authenticators: Integrating social identity providers for user authentication.
    • Federation Proxy: Using WSO2 Identity Server as a proxy for federation.
    • JIT provision users to Identity Server: Automatically creating user profiles within WSO2 Identity Server during the federated authentication process.
    • JIT provision users to cloud service providers: Automatically provisioning user identities to external cloud service providers during federated authentication.

  5. Manage user account scenarios in WSO2 Identity Server

    master

    WSO2 Identity Server provides several sub-scenarios for allowing users to manage their own accounts. These capabilities allow developers to implement self-service features such as profile updates, security credential management, and account recovery.

    Key user account management tasks include:

    • Updating user profiles: Modifying personal information.
    • Security management: Updating challenge questions, attaching FIDO tokens, and recovering passwords.
    • Consent and associations: Managing user consents and account associations.
    • Account recovery and monitoring: Recovering accounts and monitoring login activity.

  6. Manage Access with Fine-grained Policies

    master

    This scenario demonstrates how to use WSO2 Identity Server to implement fine-grained access control. Instead of simple authentication, you can define specific policies to control application access based on granular attributes or conditions.

    Key sub-scenarios include:

    • Restricting application login to users possessing a specific role.
    • Restricting application login to specific time durations.

  8. Explore Adaptive Authentication scenarios

    master

    WSO2 Identity Server supports Adaptive Authentication, which allows you to implement security policies that adjust authentication requirements based on various context and user attributes. You can implement different sub-scenarios to secure your applications, including:

    • Role-Based: Triggering additional authentication based on user roles.
    • User-Age-Based: Adjusting requirements based on the user's age.
    • Tenant-Based: Applying different policies per tenant.
    • User Store-Based: Differentiating authentication based on the user store.
    • IP-Based: Using the user's IP address as a trigger.
    • New-Device-Based: Detecting and responding to logins from unrecognized devices.
    • ACR-Based: Using Authentication Context Class Reference (ACR) to drive authentication.
    • Risk-Based: Implementing authentication based on calculated risk levels.
    • Stream Processor Integration: Using WSO2 Stream Processor for advanced adaptive authentication logic.
    • Dynamic Prompts: Using dynamic prompts within the adaptive authentication flow.

  9. Access Delegation with End-user Authorization Scenarios

    master

    This section provides implementation guides for various OAuth 2.0 and OpenID Connect (OIDC) access delegation patterns using WSO2 Identity Server. These scenarios cover different grant flows and authentication methods used to delegate access from an end-user to a client application.

    Available implementation scenarios include:

    • Authorization Code Grant Flows:
      • Standard Authorization Code Grant
      • Authorization Code Grant with PKCE (Proof Key for Code Exchange)
      • Authorization Code Grant with Private Key JWT Client Authentication
      • Authorization Code Grant with Mutual TLS (mTLS) Client Authentication
    • Other Grant Flows:
      • Implicit Grant Flow
      • Password Grant Flow
      • Client Credentials Grant Flow
      • Refresh Grant Flow
      • Self-Contained Access Token as Authorization Grant
    • Token Management:
      • Revoking an Authorization Grant

  11. Single Sign-On with Delegated Access Control Scenarios

    master

    This product scenario demonstrates how to implement Single Sign-On (SSO) combined with delegated access control. It is designed for developers to understand how to manage identity and permissions across different services using standard protocols.

    The scenario is divided into two primary sub-scenarios:

    1. Single Sign-On with SAML and Use SAML Grant Bearer: Focuses on using SAML for SSO and leveraging the SAML Grant Bearer flow for delegated access.
    2. JWT Bearer: Focuses on using JSON Web Tokens (JWT) for bearer-based delegated access control.