WSO2 Identity Server: an on-premises IAM server with an Apache 2.0 licence

An IAM server you run yourself, and a hosted sibling you do not

WSO2 Identity Server is described as a modern identity and access management solution for an on-premises or cloud environment, enabling organisations to deliver trusted digital experiences to all types of users. The repository is the source code for it, and the primary language is Java with the build driven by a pom.xml at the root. Two things in the README frame how to think about the product. The first is that the customer reasons given are developer-centric design, extensive standards support, freedom to deploy however needed, and massive scalability, and the second is a callout box pointing at a hosted alternative: Asgardeo, offered free of charge as a public identity cloud solution, described as an iDaaS built on the same technology core as Identity Server. So the two are siblings rather than competitors, one you operate and one that is operated for you, and the question a prospective adopter is really answering is which of the two they want. The licence field on the repository says Apache-2.0, which is what makes the self-hosted route a genuinely open option.

Standards coverage is the argument for the product

The repository topics are the plainest summary of the scope: access management, adaptive authentication, authentication, authorization, multi-factor authentication, OAuth2, OIDC, SAML2 and single sign-on. The standards support is what the README leans on, and it is backed up by test directories in the tree, since there are oidc-conformance-tests and oidc-fapi-conformance-tests directories alongside the jmeter-tests one. Conformance test suites in the repository are a stronger signal than a bullet in a feature list, because they mean the implementation is checked against a published test set rather than only against the vendor's own expectations. The FAPI mention gets its own section, described as the best API security available anywhere using the FAPI standard, with additional security features built on top of OAuth2, originating in financial services but now wanted by many industries. The rest of the feature sections cover a visual designer for authentication flows, templates, simplified RBAC for fine-grained API access policies, a new authentication API for in-app authentication, B2B CIAM capabilities with delegated administration and per-customer login options including enterprise identity providers, and a subscription model that controls which apps a customer sees.

The install is a JDK, a zip and a script

The getting started section is concrete about what it needs. A JDK is required, and versions from JDK 11 through JDK 21 are supported, with the full list of supported versions in the environment compatibility section of the documentation. The JAVA_HOME environment variable has to point at your JDK, and the documentation has a separate page per platform for that. Then you extract the downloaded distribution zip, go into the bin directory, and run the wso2server.sh or wso2server.bat script for your operating system. After that there are two web applications, and both are served on port 9443 over https. The Developer and Administrator Console is at https://localhost:9443/console, and the End User Portal is at https://localhost:9443/myaccount. The credential detail is stated plainly and is the first thing to change: you may sign in to either interface using the default administrator credentials, username admin and password admin. The prerequisites page also has a per-architecture and per-operating-system breakdown, so the target deployment is something you consult before you download rather than after.

The adaptive authentication and AI parts are the newer surface

Two of the listed capabilities are recent additions rather than table stakes, and they are worth separating out. The first is AI-assisted development, where natural language login flow requirements automatically generate complex authentication flows, and where assisted brand matching automatically generates the user interface components, so the visual designer and the generated flow end up consistent. The second is the new authentication API for in-app authentication, which the README describes as further streamlining user access, and it sits alongside the visual designer and the templates for configuring apps and authentication methods. The adaptive authentication topic in the repository is the older machinery, and the AI section is the direction of travel. What is notable for an engineer reading the repository is that the visual designer and the AI generation are separate items, so the generated flow is a starting point you still shape in the designer rather than a finished artefact.

A Maven multi-module build with release discipline documented

The tree shows how a large Java product is laid out. There is a pom.xml at the root and a modules directory holding the implementation, an etc directory for configuration, a docs directory, a legal directory, a product-scenarios directory, a usecases directory, and the three test directories already mentioned. Alongside the code there is the paperwork of running a product rather than a library: release-guidelines.md, a release-notes.html, a NOTICE.txt next to LICENSE and LICENSE.txt, a SECURITY.md, a CODE_OF_CONDUCT.md and an issue_template.md. The presence of release guidelines and a release notes file means the project publishes a changelog per release, and the fact that there are two licence files plus a NOTICE file is the standard arrangement for an Apache 2.0 distribution where third-party licences have to be carried. The build status badge points at a Jenkins job on the wso2.org instance rather than a GitHub Actions workflow, so the continuous integration for the master branch runs on the vendor's own server.

The 7.x line and how to report a problem

The release history is recent and staged the way a large product ships: 7.3.0 in May 2026, preceded by a release candidate in April and a beta in March, and before that the 7.2 line. The beta and release candidate tags being in the same repository is the practical detail, because it means the current source on master is a development line rather than the shipped 7.3.0, and the difference between them is where regressions hide. On reporting problems, the guidance is specific: all known issues of WSO2 Identity Server are filed in the issue tracker on the repository, and you should check that list before opening a new issue. Community support runs through a Stack Overflow tag for wso2is and a Discord server, with a Discord invite link and a follow link on the social account. The project also carries a Verified DPG badge pointing at the Digital Public Goods registry, which is a signal that the project is tracked as a public good rather than only as a vendor product, and that is consistent with the Apache 2.0 licence.

Editorial conclusion

product-is suits an organisation that wants to run identity and access management on its own infrastructure with an Apache 2.0 code base and no per-user licence, and that needs the standards coverage OAuth2, OIDC, SAML2 and FAPI. It does not suit someone who wants a hosted service with a support contract, since the README points those users at Asgardeo instead. Before you deploy it, change the default admin credentials, because the developer console and the end user portal both ship with admin and admin, and read the prerequisites page for your target architecture and operating system before you download anything.

Frequently asked questions

Official sources

1. License: Apache-2.0
2. Project website
3. README
4. Releases
5. wso2/product-is on GitHub