# Gluu > Enterprise identity and access management, built on open source. Gluu builds identity and access management software on open standards. Flex is the commercial distribution of the Janssen Project; Solo is hosted infrastructure; the Cedarling is an embeddable policy decision point. Everything here is the current source of truth for these products. ## Start here - [Gluu](https://gluu.org/): Enterprise identity and access management, built on open source. ## Products - [Solo](https://gluu.org/solo): Gluu Solo is a serverless, hosted identity provider: choose your request volume, cloud locations and SLA. - [Flex](https://gluu.org/flex): Gluu Flex is a commercial identity provider with an open source core, for self-hosted, multi-datacenter IAM infrastructure. - [Gluu 4](https://gluu.org/gluu-4): Support, security updates and component reference for legacy Gluu Server 4.x deployments. - [Agama Lab](https://gluu.org/agama-lab): Agama Lab is Gluu's developer site for finding, authoring and publishing Agama authentication projects. - [Casa](https://gluu.org/casa): Casa is a self-service credential management portal where end users enroll and remove MFA credentials. ## Company - [Documentation](https://gluu.org/docs): Every Gluu documentation set: Flex, the Janssen Project, Agama, and Gluu Server and Casa in 4.5 and 4.4. - [Release support](https://gluu.org/docs/eol): Support status for every Gluu Server release, and the archived documentation for earlier versions, oxd, Cluster Manager, Super Gluu and Gluu Gateway. - [Open source](https://gluu.org/foss): Gluu leads the Linux Foundation Janssen Project and builds its commercial products on community-governed open source. - [About](https://gluu.org/about): Gluu builds enterprise identity and access management software on an open source core, and leads the Janssen Project. - [Security](https://gluu.org/security): Gluu's security commitments, open-source security posture and responsible disclosure process. - [Roadmap](https://gluu.org/roadmap): Release cadence and support timelines for Gluu Flex and Gluu 4. - [Technology partners](https://gluu.org/technology-partners): Gluu technology partners supply FIDO2, biometrics, smart card, RADIUS and platform components used with Gluu software. - [Contact us](https://gluu.org/contact-us): How to reach Gluu about commercial engagements, support and open source questions. ## Documentation - [Documentation center](https://gluu.org/docs): Every Gluu documentation set: Flex, the Janssen Project, Agama, and Gluu Server and Casa in 4.5 and 4.4. - [Gluu Flex](https://gluu.org/docs/flex): Documentation for the current Gluu Flex release, including Open Banking. - [Gluu Server 4.5](https://gluu.org/docs/gluu-4): Documentation for Gluu Server 4.5. - [Gluu Casa 4.5](https://gluu.org/docs/gluu-4/casa): Documentation for Gluu Casa 4.5. - [Gluu Server 4.4](https://gluu.org/docs/gluu-4/4.4): Documentation for Gluu Server 4.4, which is still supported. - [Gluu Casa 4.4](https://gluu.org/docs/gluu-4/4.4/casa): Documentation for Gluu Casa 4.4, which is still supported. - [Release support](https://gluu.org/docs/eol): Support status for every Gluu Server release, and the archived documentation for earlier versions, oxd, Cluster Manager, Super Gluu and Gluu Gateway. ## Blog - [Janssen Project is a Digital Public Good](https://gluu.org/janssen-project-is-a-digital-public-good): Citizens want to use the Internet to connect to their government for a myriad of reasons. Wouldn’t it be great if you could use the Web to pay your taxes, vote, obtain a driver’s license, or apply… - [Multi Master Multi-Cluster LDAP (OpenDJ) replication in Kubernetes? A controversial view](https://gluu.org/opendj-is-a-lightweight-directory-access-protocol-ldap-compliant-distributed-directory-written-in-java-many-organizations-use-it-as-a-persistence-mechanism-for-their-iam-systems): OpenDJ is a Lightweight Directory Access Protocol (LDAP) compliant distributed directory written in Java. Many organizations use it as a persistence mechanism for their IAM systems. But should it be… - [Gluu Flex Roadmap](https://gluu.org/gluu-flex-roadmap): As Flex is a commercial distribution of the Janssen Project, check the Janssen Nightly Build changelog and issues. You can also check the Nightly Build changelog for the Admin UI. Gluu 4 is… - [Enhancing Secure Mobile Authentication with OAuth, Dynamic Client Registration, and DPoP](https://gluu.org/enhancing-secure-mobile-authentication-with-oauth-dynamic-client-registration-and-dpop): 🔒 Discover the latest insights from Mike Schwartz on authentication protocols, including OAuth, Dynamic Client Registration, and DPoP, in this thought-provoking blog post. OpenID is a federated… - [The Ten Buts of Govstack’s Identity Building Block](https://gluu.org/the-ten-buts-of-govstacks-identity-building-block): Each Govstack specification offers a blueprint of a digital service landscape. Assuming you think this is possible, among the various Govstack specs, the most important is the GovStack Identity… - [“Workload Identity”: It’s SPIFFY, but Central Policy Management?](https://gluu.org/workload-identity-its-spiffy-but-central-policy-management): SPIFFY Mutual TLS (mTLS) is a way to secure workload identity and communication in a distributed system using the SPIFFE and SPIRE standards. (see also: https://spiffe.io/) SPIFFE stands for Secure… - [4 Learnings: DPGA Meeting 2023](https://gluu.org/4-learnings-dpga-meeting-2023): I attended the DPGA annual meeting in Addis Ababa, Ethiopia. It was my first time meeting in person many of the people in that community and learning about the laudable goals of the DPG Alliance… - [Keycloak Roadmap](https://gluu.org/keycloak-roadmap): by Michael Schwartz, CEO of Gluu The recent announcement that Keycloak is joining the CNCF as an incubating project was welcome news!!! It resolved two important questions. How would Red Hat transfer… - [Inter-Operable Identity Journeys with Agama](https://gluu.org/inter-operable-identity-journeys-with-agama): As developers, we love the convenience of cloud identity, but we also want the flexibility to meet our exact business requirements for login, registration, and account recovery. Most good cloud… - [APAC Digital Identity Unconference 2023: Notes from Session 1](https://gluu.org/apac-digital-identity-unconference-2023-notes-from-session-1): with Mike Schwartz at APAC Digital Identity Unconference 2023 Modern authentication has evolved significantly. In the past, a single web page, typically a username/password form, would be presented… - [Gluu 4.4.2 Fixes and Enhancements](https://gluu.org/gluu-4-4-2-updates): Gluu 4.4.2 Release Notes Two-factor authentication refactor: class smtp connect protection type has been updated (according to sonar requirements); feat: encrypting keystore password has been added;… - [Whispeak and Gluu Launch Strategic Partnership](https://gluu.org/gluu-and-whispeak-announce-partnership): Lille, France — Whispeak, a voice biometrics-powered authentication system company, which provides frictionless and continuous authentication with voice biometrics, announces the launch of a new… - [3 Ways Banks Secure their Open Banking APIs with Gluu](https://gluu.org/open-banking-apis-2022): Open Banking initiatives enable third parties to process financial transactions for consumers, creating new competitive offerings. Open banking is not only a cost to banks but a new revenue… - [Gluu 4 supports Apple platform FIDO 2 like TouchID](https://gluu.org/support-fido2-webauthn-touchid): The first laptop to build in FIDO was the Google Pixelbook (RIP). It was a little geeky–you enabled a hidden ChromeOS feature to activate FIDO U2F via the laptop power button. But Apple has taken… - [Strong Protection in the Era of Rising Threats](https://gluu.org/strong-protection-in-the-era-of-rising-threats): Today’s cyberspace and IT systems have transformed from a uniformed homogeneous structure brought on by a fixed workspace and data center system to a heterogeneous network consisting of innovative… - [Provision Users for AWS with Gluu](https://gluu.org/provision-users-with-gluu-4-2022): This article will guide you through how to use SCIM to provision users on a Gluu 4 instance and configure Single-Sign-On (SSO) with Amazon Web Services. To begin, ensure the Shibboleth IDP and SCIM… - [SP initiated SAML flow for Gluu Solo](https://gluu.org/sp-initiated-saml-flow-for-gluu-solo): This article will guide you through the process of a Service Provider (SP) initiated SAML flow for single sign-on (SSO) using Gluu as the Identity Provider (IDP). We will be using a locally run Flask… - [Integrating Gluu Server with tru.ID](https://gluu.org/truid-integration): It’s a modern axiom that passwords are bad. But there are still many deployment challenges for organizations to rollout two-factor authentication, such as requiring end users to purchase hardware or… - [Gluu Advisory: Okta Twilio Cyberattack](https://gluu.org/okta-twilio-cyberattack): Gluu would like to provide this bulletin to advise our community about the recent attacks on Twilio the suggested OTP SMS service configured through oxAuth and Casa. Affects all Gluu 3.X and 4.X… - [Install RHEL 8 with the DISA STIG Security Profile](https://gluu.org/installing-gluu-server-on-rhel-8-with-the-disa-stig-security-profile): A Secure Technical Implementation Guide (“STIG”) is a document published by the Department of Defense Cyber Exchange (DoD), which is sponsored by the Defense Information Systems Agency (DISA). It… ## Identerati Office Hours - [Episode 233: Agents have keys. Who checks what they did with them?](https://gluu.org/office-episodes/episode-233-agents-have-keys-who-checks-what-they-did-with-them): Identity work has gotten good at saying who an agent is: keys, delegation, mandates, verifiable credentials. It says much less about what the agent then did, and that's where disputes, audits and… - [Episode 232: Navigating IAM Market Evolution](https://gluu.org/office-episodes/episode-232-navigating-iam-market-evolution): Identity and access management has quietly become critical enterprise infrastructure. Yet organizations still buy IAM capabilities from a fragmented market that introduces and promotes new categories… - [Episode 230: Detecting One Bad Access Among Billions](https://gluu.org/office-episodes/episode-230-detecting-one-bad-access-among-billions): Google’s Facade uses deep contextual anomaly detection to find suspicious insider activity hiding among billions of legitimate access events. Trained only on normal historical activity, it compares… - [Episode 231: Beyond Zero: Enterprise Security for the AI Era](https://gluu.org/office-episodes/episode-231-beyond-zero-enterprise-security-for-the-ai-era): Google’s ground breaking Beyond Zero architecture could influence the security landscape for the next decade. And it signals a shift from identity to capability based access governance--principle #1… - [Episode 229: Oblique: IGA without an identity team](https://gluu.org/office-episodes/episode-229-oblique-iga-without-an-identity-team): Most identity governance assumes someone owns identity. But often at a startup nobody does, yet you still need to provision access to new users, and still need to complete access reviews for SOC 2.… - [Episode 228: Your Agents Don't Have Passwords](https://gluu.org/office-episodes/episode-228-your-agents-dont-have-passwords): AI agents are already inside the enterprise — booking meetings, processing invoices, querying databases, publishing content — and not one of them has a password. They authenticate through OAuth… - [Episode 227: Trust in Digital ID Ecosystems](https://gluu.org/office-episodes/episode-227-trust-in-digital-id-ecosystems): Across the planet, Digital ID Ecosystems are being built using technology from all of us in this community. They all face common questions that no technology can answer: “Once launched... How do we… - [Episode 226: UMA What's Next?](https://gluu.org/office-episodes/episode-226-uma-whats-next): "May your agent touch my stuff?" Answering it needs an authority on the owner's side, one the resource server does not control, and it needs a negotiation to fill that authority in while the owner is… - [Episode 225: Agentic Identity & AI Security — Then vs. Now](https://gluu.org/office-episodes/episode-225-agentic-identity-ai-security-then-vs-now): A lot has happened since Tanu's talk at Identiverse a few months back: "Runtime Identity: Trust at the Speed of AI". Although it's just been four human months, it's been four years in agent time.… - [Episode 224: We Told You Authorization Matters](https://gluu.org/office-episodes/episode-224-we-told-you-authorization-matters): We had the answer to authorization 20 years ago. Most organizations just never implemented it properly. From XACML to UMA to Zero Trust to APIs, microservices, and now AI agents, we'll talk through… - [Episode 223: GovOps Version 0.0.1](https://gluu.org/office-episodes/episode-223-govops-version-0-0-1): With it's first release, OWASP GovOps officially starts iterating three deliverables: (1) a new standard for inventorying enterprise authorization capabilities; (2) an architecture describing GovOps;… - [Episode 222: Sandbox Escape: AI Agents Gone Rogue](https://gluu.org/office-episodes/episode-222-sandbox-escape-ai-agents-gone-rogue): AI agents escaping sandboxes make great headlines—but what do these incidents actually tell us about enterprise AI risk? Mike and Henrique examine the OpenAI/Hugging Face incident, the hype around… - [Episode 221: The Security Problem Starts When AI Agents Act](https://gluu.org/office-episodes/episode-221-the-security-problem-starts-when-ai-agents-act): AI agents are rapidly moving from assistants that generate suggestions to systems that can transact. That changes the security model: the important question is no longer just “What did the AI say?”… - [Episode 220: Not Promises: Attesting What Your AI Agent Is](https://gluu.org/office-episodes/episode-220-not-promises-attesting-what-your-ai-agent-is): Identity infrastructure answers who called. Agentic systems must also answer what was actually running. Imran Siddique, Chief Platform Officer at OPAQUE, will show how hardware attestation can verify… - [Episode 219: Agentgateway: Keep Infrastructure Out of Your AI Agents](https://gluu.org/office-episodes/episode-219-agentgateway-keep-infrastructure-out-of-your-ai-agents): The Linux Foundation Agentic AI Foundation (AAIF) recently accepted the agentgateway open source project as the fourth project alongside MCP (spec), AGENTS.md, and Goose. Conceptually, an… - [Episode 218: Agent Trust Registries](https://gluu.org/office-episodes/episode-218-agent-trust-registries): An Agent Trust Registry is a system that maintains an identifier, verified provenance, trust, policy, and behavioral metadata about AI agents, autonomous workloads, and machine actors so that other… - [Episode 217: 5 billion passkeys. Are we done yet?](https://gluu.org/office-episodes/episode-217-5-billion-passkeys-are-we-done-yet): Topics to cover: Adoption, Measurement, Recovery and migration, Residual threats, Transaction security, Phishing-resistant accounts not only phishing resistant credentials, relationship to digital… - [Episode 216: Why "Know Your Agent" Frameworks Fail AI Security](https://gluu.org/office-episodes/episode-216-why-know-your-agent-frameworks-fail-ai-security): How could social media networks do a better job at personal identification? How to preserve both anonymity and accountability. - [Episode 215: Cedar Gets Temporal: Meet Dogwood](https://gluu.org/office-episodes/episode-215-cedar-gets-temporal-meet-dogwood): AWS’s new open source Dogwood project extends Cedar with temporal policies that govern what an agent can do based on what happened earlier. Dogwood can express rules like “approval must happen… - [Episode 214: Get the Most Out of Identity Solution Providers](https://gluu.org/office-episodes/episode-214-get-the-most-out-of-identity-solution-providers): Celebrate! You (or maybe your boss) has found THE killer identity startup -- it solves a long-standing problem in your Enterprise Identity ecosystem and they're eager to deploy a free Proof of… ## Agama Project of the Week - [How To Integrate Agama‐Lab Github App With Your GitHub Account](https://gluu.org/agama/how-to-integrate-agama‐lab-github-app-with-your-github-account): This app enables developers to specify granular repository access control for the Agama Lab code authoring tool. See here why the Agama Lab requires access to the GitHub account. To integrate the… - [Test Agama Lab Projects](https://gluu.org/agama/test-agama-lab-projects): Coming Soon - [Authorization Policy Designer](https://gluu.org/agama/authorization-policy-designer): Policy designer tool provides you a visual editor to build, manage, and test authorization policies written in Cedar language. Policy designer helps you quickly test these policies to authorise users… - [Explore Section](https://gluu.org/agama/explore-section): Explore section lists all the community-contributed, ready-to-use Agama projects. It contains the most frequently used authentication journeys like passwords, passkeys, SMS-OTP, E-Mail OTP, etc.… - [Node Types](https://gluu.org/agama/node-types): A flow in Agama flow visual editor comprises of several connected nodes. Each node represents an Agama DSL directive. Each node also allows the user to pass parameters to the underlying Agama DSL… - [Project Editor](https://gluu.org/agama/project-editor): Project editor is the development tool to write authentication flows. It has a low-code editor that can be used to drag and drop the code blocks and the actual Agama code gets generated in the… - [Agama Lab Project Dashboard](https://gluu.org/agama/agama-lab-project-dashboard): Project Dashboard lists projects in the repository and releases attached to those projects. A project from the dashboard can be opened in the project editor for modifications. When the user has not… - [Flow Designer](https://gluu.org/agama/flow-designer): Authentication Flow Designer is a complete set of tools that you need to build, manage, maintain, and test your Agama projects and authentication flows. You can use the flow designer to After… - [Sign Up Sign In](https://gluu.org/agama/sign-up-sign-in): You can sign into the Agama Lab using your GitHub account(recommended) or using your email ID. If you haven’t registered your email ID before, then the registration form will get you started. The… - [Introduction To Agama Lab](https://gluu.org/agama/introduction-to-agama-lab): Agama Lab is your web-based toolbox for authoring authentication and authorization projects. It offers drag and drop interface for authoring authentication flows using the Flow Designer while policy… - [Agama Hellō](https://gluu.org/agama/agama-hello): In this video, I will be discussing Agama Hello, a fascinating Agama Project that allows you to integrate Hanno co-op’s social integration services into your authentication journey. I will explain… - [Agama Flow](https://gluu.org/agama/agama-flow): Agama is a framework that consists of: Here, a web flow is understood as a process composed of one or more stages, where at each stage an actor – normally a person – provides some kind of data or… - [Project Orchestration](https://gluu.org/agama/project-orchestration): This section provides you a set of tools to manage projects’ flows, web template pages, java code file, and other project assets. Below are some tools and tips to use project orchestration: Beside… - [Agama Projects](https://gluu.org/agama/projects): This section provides you a set of tools to create and manage agama projects. You can add one or multiple projects in one Reposotory. Note: In above screenshot, it is published repository. You cannot… - [Log into Agama Lab](https://gluu.org/agama/log-into-agama-lab): Use https://cloud.gluu.org/agama-lab online tool to make an agama flow. Hit the above URL and you will see a page with the Sign in with GitHub button. Click on it and give access to agama-lab.… - [SecurityKey](https://gluu.org/agama/securitykey): This video focuses on the Agama Security Key project, which involves a physical USB device, also known as a FIDO token, used for authentication. Users simply plug in or tap their security key to… - [OpenID](https://gluu.org/agama/openid): Watch the recording Overview and Demo of Gluu’s Agama OpenID project, for connecting to external OpenID Providers. I show an out-of-the-box configuration where you just list the external providers in… - [TOTP](https://gluu.org/agama/totp): Watch the recording In this video, I discuss Agama TOTP, to enable people to enroll and authenticate with standard OATH TOTP apps like Google Authenticator. I demonstrate how to deploy the project… - [Forgot-PW / Registration](https://gluu.org/agama/agama-smtp): Watch the recording Welcome to Agama Project of the Week! In this video, I, Mike Schwartz, founder of Glu, will be discussing Agama SMTP, a project governed by Glu and published under the Apache 2… - [Agama PW](https://gluu.org/agama/agama-pw): Watch the recording In this video, I present Gluu’s Agama Password Project, which is published in the Explorer Catalog. I demonstrate how to log into Agamalab, fork the project, and explore the code… ## Archives - [All blog posts](https://gluu.org/blog) - [All episodes](https://gluu.org/identerati-office-hours-episodes) - [All Agama write-ups](https://gluu.org/agama-project-of-the-week) - [Service partners](https://gluu.org/partners) - [Sitemap](https://gluu.org/sitemap.xml)