Gluu 4
Need support for Gluu Server 4.x?
If you run a legacy Gluu Server 4.x infrastructure and want the latest security updates, you need a Gluu subscription. For free binary distributions, see the Janssen Project, a Gluu 4 fork contributed to the Linux Foundation in 2020.
Why organizations stay on Gluu 4
Scale
Very large deployments where control of scalability is critical. The cloud-native distribution scales out by adding servers on the fly.
Privacy
Self-hosting keeps personal data and secrets, including user passwords and client credentials, in a database you control rather than a shared multi-tenant one.
Control
Custom code can be added at many points in the authentication and authorization workflow, in Python or Java, instead of bending a fixed workflow GUI.
Components
oxAuth
The core OpenID Connect identity provider and OAuth authorization server: renders login pages, authenticates clients and issues tokens. One of the most comprehensively certified OAuth and OpenID providers available.
Casa
An out-of-the-box authentication flow and an extensible self-service portal where end users view, add and enroll MFA credentials. Plugins exist for FIDO, OTP, SMS, smart card and Duo.
Database
LDAP, Couchbase and RDBMS are all supported. LDAP suits data that fits one server, SQL suits an existing database service, Couchbase suits sharded multi-datacenter deployments.
Passport
A federation broker for SAML IDPs and social login, built on Passport.js, invoked through a person interception script so business-specific requirements stay possible.
Shibboleth SAML IDP
SSO with SAML service providers without hand-editing XML: create trust relationships and release attributes through the admin UI or configuration API.
oxTrust admin
The web control plane for configuring the server and its trust relationships.
Support timeline
Gluu 4 is on a quarterly release cycle, supported through 31 December 2027 with price increases tracking U.S. CPI. Extended support covers 2028 and 2029 at 15% increases; 2030 and beyond depends on demand.
The source code remains open; see the oxAuth and oxTrust projects.