Gluu Flex · Self-hosted IAM
Identity infrastructure you own, for people and workloads
Some businesses must self-host authentication and authorization rather than hand them to a cloud service. Gluu Flex is a software distribution for building multi-datacenter, highly available identity and access management infrastructure.
- Apache 2.0 open-source core
- Monthly releases
- Priced on peak MAU
Linux Foundation project
Janssen core, governed by a technical steering committee
Digital Public Good
Janssen is listed in the DPGA registry
Apache 2.0 core
Every Janssen component is open source
DISA STIG profile
Optional deployment profile for Red Hat Linux
Monthly releases
Published support window per version
Why self-host
Some identity can't be rented
For governments, banks, telcos and global consumer brands, authentication is critical infrastructure. It has to run where the data is allowed to live, scale across datacenters, and outlast any vendor relationship.
Sovereignty and residency
User records, sessions, keys and audit logs stay in your clusters, in your jurisdiction, under your operators. No US SaaS in the login path.
Regulators and auditors
Hardened profiles (DISA STIG for RHEL), an Open Banking distribution, and decision and audit logs streamed to the SIEM your auditors already use.
Scale without a per-user tax
Citizen- and consumer-scale populations are mostly dormant. Flex is billed on peak monthly active users, so you don't pay for accounts that never sign in.
Resilience across datacenters
Cloud-native clusters spread across datacenters and clouds, so a regional outage doesn't take sign-in down with it.
- components in one distribution, from OpenID Provider to embedded policy engine
- 10
- use cases supported out of the box, from SSO to Open Banking
- 16
- support per major version: maintenance to GA + 12 months, end of life at GA + 24
- 24 mo
- support for production deployments
- 24/7/365
Why Gluu Flex
Built for the platform team that has to run it
Flex is what you deploy when identity is a production system with an on-call rotation, not a login box.
Multi-datacenter by design
Cloud-native from the ground up: Helm charts for Amazon EKS, Google GKE, Microsoft AKS and Rancher, with MySQL or PostgreSQL and an optional Redis cache. Use the database infrastructure you already operate instead of a single-purpose LDAP topology.
Highly available · horizontally scaled
100% configuration as code
Every setting is reachable through the Config API, the CLI and Helm values, so identity changes go through the same review, pipeline and rollback as the rest of your stack. The Admin UI is for reporting and audit, not a dependency.
# override.yaml (excerpt) global: fqdn: login.example.gov cnPersistenceType: sql
No lock-in
If a subscription expires, the commercial Admin UI locks and authentication keeps running. The core is Apache 2.0, so you can keep it configured with open-source tools or move to the Janssen distribution.
Standards depth
OpenID Connect, OAuth 2.0, SAML 2.0, SCIM, FIDO2 and passkeys, UMA 2.0, CIBA, OpenID Federation, OAuth Transaction Tokens and OAuth Status Lists, plus an Open Banking profile with PAR and JARM.
Fair, predictable pricing
One subscription priced on peak monthly active users, with the support terms written into it. No per-node fees and no charge for dormant accounts.
Inside the platform
Ten components, one supported distribution
Flex ships every component of the Janssen Project plus the commercial Admin UI, tested together and released monthly. Select a component to see what it does.
Component
Auth Server
Open source
The OpenID Provider and OAuth 2.0 authorization server at the center of every login and token.
- OpenID Connect, OAuth 2.0, UMA 2.0, CIBA and device flow
- JWT access tokens with real-time revocation via OAuth Status Lists
- Dynamic client registration with software statements
- OAuth Transaction Tokens for service-to-service context
Flex Admin UI · commercial
See what your identity estate is doing
A web control plane for reporting and audit: monthly active users and clients, FIDO metrics and the Passkey Security Monitor, logs and audit entries, webhooks, and Cedar policy-store management. Its own permissions are enforced by Cedarling.
People · Workloads · AI agents
One control plane for every identity that acts
Services, scripts and AI agents now make more access decisions than people do. Flex issues their tokens, Cedarling decides locally what each one may do, and every decision lands in your security tooling.
Scoped tokens for every caller
The Auth Server mints application-scoped JWTs for people and workloads, and OAuth Transaction Tokens carry who-asked-for-what across service hops.
Decisions where the action happens
Cedarling runs inside the app, gateway or agent and evaluates the token and the Cedar policy locally, in under 50 µs, with no round trip to a central server.
Revoke in real time, prove it later
OAuth Status Lists revoke tokens without waiting for expiry. Lock collects decision logs and telemetry from every Cedarling, and Flex streams them to your SIEM or ITDR.
Use cases
Where Flex runs the front door
Flex is built for organizations that need identity at national, financial or global-consumer scale, and can't hand it to a cloud service.
Government and public sector
Citizen sign-in and agency federation on sovereign infrastructure, with a foundation-governed, Digital Public Good core.
- OpenID Federation and SAML federation
- DISA STIG profile for RHEL
- Smart card and FIDO authentication
Financial services and Open Banking
A packaged Open Banking distribution for banks, fintechs and payment providers, with non-bank services switched off.
- Dynamic client registration with software statements
- PAR, JARM and CIBA
- Payment authorization and eKYC flows
Large-scale consumer identity
Registration, social login and passwordless for millions of customers across regions, priced on who actually signs in.
- Social login via Agama (Google, Apple, Microsoft Entra ID)
- Passkeys and self-service MFA in Casa
- Mobile and device-flow authentication
Workforce and partners
Single sign-on and step-up authentication for employees and partners, connected to the directories you already run.
- Active Directory or Keycloak synchronization
- SCIM provisioning
- Stepped-up authentication
All 16 supported use cases
Show all 16Hide the list
- OpenID Federation
- SAML federation
- Single sign-on (SSO)
- Mobile authentication
- Web identity orchestration
- API client management and dynamic registration
- Multi-factor authentication and passwordless
- Active Directory or Keycloak synchronization
- Self-service credential management
- Open Banking
- OAuth federation with published software statement key material
- Internal identity connection via SCIM
- Stepped-up authentication
- Smart card and FIDO authentication
- OTP and email authentication, including message signing
- Device flow authentication
Deployment
Run it where your policies say it must run
Production runs on Kubernetes. Everything else is there to get you to production faster.
KubernetesProduction
Helm charts for Amazon EKS, Google GKE, Microsoft AKS, Rancher (Apps → Charts) or your own clusters. A Terraform example for EKS is in the repository.
Linux VMDev / staging
Packages for Ubuntu 22.04 and 24.04, Debian 13, SLES 16 and openSUSE Leap 16, and RHEL 9 and 10, for development and staging environments.
Quick startEvaluate
MicroK8s or Docker all-in-one, or local Kubernetes with Minikube, to try Flex on a laptop before you size a cluster.
Air-gappedTalk to us
For networks with no outbound access, licensing is arranged with our team.
Open source or commercial
Janssen Project or Gluu Flex?
Same open-source core. Flex adds what a regulated production deployment needs from a vendor.
| Capability | Janssen Project | Gluu Flex |
|---|---|---|
| License | Apache 2.0 | Commercial subscription on an Apache 2.0 core |
| Governance | Linux Foundation, technical steering committee | Same upstream; Gluu builds and tests the distribution |
| Components | Auth Server, Config API, Casa, SCIM, FIDO, Agama, Lock, Cedarling, Link | Every Janssen component plus the Flex Admin UI |
| Reporting and audit UI | Not included | Included: MAU dashboard, FIDO metrics, Passkey Security Monitor, logs, policy store |
| Releases | Monthly community releases | Monthly distribution shortly after each Janssen release |
| Support lifecycle | Community best effort | Published: maintenance to GA + 12 months, end of life at GA + 24 months |
| Support | Community chat and GitHub | Gluu support desk, 24/7/365 |
| If the subscription lapses | Not applicable | Admin UI locks; authentication keeps running; move to Janssen at any time |
| Implementation | Do it yourself | Gluu service partners in Asia, Europe, the Americas, Africa and the Middle East |
| Price | Free | Peak monthly active users |
Coming from somewhere else
Move at your own pace
From Gluu Server 4
Flex is the successor to Gluu Server 4, which stays supported until 31 December 2027, with extended support for 2028 and 2029 at a published price, so you can plan the move instead of rushing it.
From Keycloak
Jans Link synchronizes users from Keycloak, LDAP or Active Directory, so you can run both side by side and cut over application by application.
With a local partner
Get direct help from Gluu's service partners in Singapore, India, Australia, Europe, Brazil, Hong Kong, South Africa, Argentina, the UK, Spain and the Middle East.
Resources
Go deeper
Documentation
Gluu Flex docs
Installation, administration, Admin UI and Helm reference, current to 6.6.1.
Policy
Version support policy
Maintenance and end-of-life dates for every Flex release, for your procurement file.
Distribution
Open Banking on Flex
The packaged profile for banks: DCR, payment authorization, eKYC, CIBA, PAR and JARM.
Roadmap
What's coming
Release cadence and the priorities for Flex, Janssen and Gluu Server 4.
Video
Identerati Office Hours
Weekly live conversations on identity standards, authorization and agents.
Open source
The Janssen Project
Apache 2.0, Linux Foundation governance and a Digital Public Good.
Hosted
Gluu Solo
Gluu Flex, hosted and run by Gluu on Google Cloud, for teams that would rather not operate it.
FAQ
Questions architects ask first
What is the difference between the Janssen Project and Gluu Flex?
Janssen is the Apache 2.0 open-source project hosted by the Linux Foundation. Gluu Flex is Gluu's commercial distribution of it: every Janssen component plus the Flex Admin UI, a tested monthly release, a published support lifecycle and a commercial subscription.
What happens if our subscription ends?
The commercial Admin UI locks, but authentication keeps running. The core components are open source, so you can keep configuring them with open-source tools or move to the Janssen Project distribution.
How is Flex priced?
On peak monthly active users, so you don't pay for users who never sign in. There's a 30-day trial; licenses up to 1,600 MAU can be bought self-serve on Agama Lab, and larger deployments are quoted.
Where can Flex run, and which databases does it use?
In production on Kubernetes with Helm charts (Amazon EKS, Google GKE, Microsoft AKS, Rancher or your own clusters), with MySQL or PostgreSQL and an optional Redis cache. Linux VM packages and all-in-one quick starts are for development and staging. Air-gapped deployments are arranged with our team.
How does Flex handle services and AI agents, not just people?
The Auth Server issues tokens to workloads as well as people, including application-scoped JWTs and OAuth Transaction Tokens. Cedarling, the embedded policy engine, checks each token and action against Cedar policies inside the app, gateway or agent, and Flex collects its decision logs for your SIEM or ITDR. Tokens can be revoked in real time with OAuth Status Lists.
Can we migrate from Gluu Server 4 or Keycloak?
Yes. There's a documented migration path from Gluu Server 4, which stays supported until the end of 2027. From Keycloak, Jans Link synchronizes users so both can run side by side during the move.
Does Gluu provide implementation services?
Gluu's service partners around the world design, deploy and operate Flex for customers who want help. Gluu provides the software and the support.
Talk to an architect
See how Flex fits your architecture
Bring your diagram and your constraints. A Gluu engineer will walk through them with you, not a sales script.
- Deployment model for your regions, clouds or datacenters
- Migration path from what you run today
- Sizing on peak MAU, and the support terms that come with it
- A service partner near you, if you want one
Or email sales@gluu.org.