Nacho
Gluu IAM Provider
Open-source identity and access management platform from Austin, Texas, built around the Linux Foundation's Janssen Project (Apache 2.0), which implements OAuth 2.0, OpenID Connect, SAML 2.0, FIDO2, SCIM 2.0, and UMA 2.0. Free to self-host; Gluu Flex is the commercial distribution adding a hosted control plane, Cedarling (an embeddable Cedar-based policy decision point for fine-grained ABAC), Agama Lab (a low-code authentication workflow designer), and enterprise support. Historically known as the Gluu Server; increasingly positioned around Zero Trust and AI agent/workload identity.
Features
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for Gluu’s OpenID Connect protocol compatibility? View Gluu on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Gluu support Username and Password authentication method?
Gluu supports Username and Password authentication method. Core authentication against the configured persistence layer (LDAP, MySQL, PostgreSQL, Couchbase, or Spanner). Read more
Does Gluu support Social Sign-in authentication method?
Gluu supports Social Sign-in authentication method. Inbound identity from Google, Facebook, Apple, and other providers historically via the Passport.js module; configurable today via Agama or custom interception scripts. Read more
Does Gluu support Passkey authentication method?
Gluu supports Passkey authentication method. FIDO2/WebAuthn passkey enrollment and authentication via the jans-fido2 component. Read more
Does Gluu support Email Passwordless authentication method?
Gluu partially supports Email Passwordless authentication method. No built-in email-OTP authenticator; achievable via a custom Agama flow or person authentication script. Read more
Does Gluu support Phone Passwordless authentication method?
Gluu partially supports Phone Passwordless authentication method. No built-in SMS-OTP passwordless authenticator; achievable via custom Agama flow integrating an SMS provider. Read more
Does Gluu support Anonymous / Guest authentication method?
Gluu does not support Anonymous / Guest authentication method. Gluu requires an identified user or client for authentication; no anonymous/guest session concept.
Does Gluu support Time-based One-Time Password (TOTP) MFA?
Gluu supports Time-based One-Time Password (TOTP) MFA. TOTP one-time password authenticator, enrollable via Gluu Casa self-service portal. Read more
Does Gluu support HMAC-based One-Time Password (HOTP) MFA?
Gluu supports HMAC-based One-Time Password (HOTP) MFA. OTP interception script supports both HOTP and TOTP modes. Read more
Does Gluu support Universal 2nd Factor (U2F) MFA?
Gluu partially supports Universal 2nd Factor (U2F) MFA. Legacy FIDO U2F devices supported for migration; new enrollments use FIDO2/WebAuthn. Read more
Does Gluu support WebAuthn MFA?
Gluu supports WebAuthn MFA. Read more
Does Gluu support Email Code MFA?
Gluu partially supports Email Code MFA. Achievable via custom person authentication script; no built-in email-code authenticator.
Does Gluu support Phone Code MFA?
Gluu partially supports Phone Code MFA. SMS OTP as a second factor achievable via custom script/Agama flow rather than a built-in authenticator.
Does Gluu support Push Notification MFA?
Gluu supports Push Notification MFA. Super Gluu is Gluu's free mobile app providing out-of-band push-notification 2FA, backed by FIDO U2F key enrollment. Read more
Does Gluu support Adaptive / Risk-Based MFA MFA?
Gluu supports Adaptive / Risk-Based MFA MFA. Context-based/risk-based authentication flows configurable through Agama low-code workflows and interception scripts. Read more
Does Gluu support Cisco Duo MFA?
Gluu supports Cisco Duo MFA. Duo Security interception script available for MFA integration. Read more
Does Gluu support Step-Up Authentication MFA?
Gluu supports Step-Up Authentication MFA. ACR (Authentication Context Class Reference) values let relying parties request a stronger authentication method for a given transaction. Read more
Does Gluu support OpenID Connect (OIDC) integration protocol?
Gluu supports OpenID Connect (OIDC) integration protocol. Read more
Does Gluu support SAML 2.0 integration protocol?
Gluu supports SAML 2.0 integration protocol. SAML 2.0 IdP support via the bundled Shibboleth Identity Provider module. Read more
Does Gluu support WS-Federation integration protocol?
Gluu does not support WS-Federation integration protocol.
Does Gluu support Machine-to-Machine (M2M) Authentication integration protocol?
Gluu supports Machine-to-Machine (M2M) Authentication integration protocol. OAuth 2.0 client credentials grant, plus UMA 2.0 for API resource protection. Read more
Does Gluu support OpenID Connect (OIDC) Federation identity federation?
Gluu supports OpenID Connect (OIDC) Federation identity federation. Inbound OIDC identity provider federation configurable via Agama or interception scripts. Read more
Does Gluu support SAML 2.0 Federation identity federation?
Gluu supports SAML 2.0 Federation identity federation. SAML federation via the Shibboleth IdP module, including third-party SP/IdP metadata exchange. Read more
Does Gluu support Active Directory / LDAP identity federation?
Gluu supports Active Directory / LDAP identity federation. LDAP is one of the pluggable persistence backends, with direct Active Directory bind supported. Read more
Does Gluu support Azure Active Directory (Entra ID) identity federation?
Gluu supports Azure Active Directory (Entra ID) identity federation. Azure AD/Entra ID federation via generic OIDC or SAML identity provider configuration. Read more
Does Gluu support Bulk User Import user management?
Gluu supports Bulk User Import user management. Bulk user import via the SCIM 2.0 API or direct persistence-layer import (LDIF/SQL). Read more
Does Gluu support Password Hash Import (Multiple Formats) user management?
Gluu supports Password Hash Import (Multiple Formats) user management. Legacy password hash/credential migration supported via a custom person authentication ("lazy migration") script. Read more
Does Gluu support Bulk User Export user management?
Gluu supports Bulk User Export user management. Bulk user export via the SCIM 2.0 API. Read more
Does Gluu support Bulk User Update / Delete user management?
Gluu supports Bulk User Update / Delete user management. SCIM 2.0 PATCH/DELETE operations for bulk update and delete. Read more
Does Gluu support Upsert on Import user management?
Gluu supports Upsert on Import user management. SCIM 2.0 PATCH supports upsert-style updates. Read more
Does Gluu support Legacy Username Import (Non-Allowed Characters) user management?
Gluu partially supports Legacy Username Import (Non-Allowed Characters) user management. Username constraints depend on the configured persistence backend; no universal normalization built in.
Does Gluu support Inbound SCIM Provisioning user management?
Gluu supports Inbound SCIM Provisioning user management. SCIM 2.0 server (RFC 7642/7643/7644) exposes CRUD endpoints for Users and Groups. Read more
Does Gluu support SCIM Groups Provisioning user management?
Gluu supports SCIM Groups Provisioning user management. Read more
Does Gluu support Just-In-Time (JIT) User Provisioning user management?
Gluu supports Just-In-Time (JIT) User Provisioning user management. Just-in-time user creation on first federated (social/SAML/OIDC) login via interception scripts or Agama flows. Read more
Does Gluu support Lazy / Trickle Migration from Legacy Database user management?
Gluu supports Lazy / Trickle Migration from Legacy Database user management. Custom person authentication script pattern validates credentials against a legacy system and migrates the user on first login. Read more
Does Gluu support Self-Service Profile Management Portal user management?
Gluu supports Self-Service Profile Management Portal user management. Gluu Casa is a self-service portal for password reset and credential (FIDO2, TOTP, Super Gluu, SMS, X.509) management. Read more
Does Gluu support User Account Linking user management?
Gluu partially supports User Account Linking user management. Achievable via custom interception scripts during federated login; no built-in account-linking UI.
Does Gluu support User Blocking / Banning user management?
Gluu supports User Blocking / Banning user management. User accounts can be disabled via SCIM (active=false) or the admin UI/TUI. Read more
Does Gluu support User Metadata user management?
Gluu supports User Metadata user management. Custom user attributes stored in the configured persistence backend and exposed via SCIM. Read more
Does Gluu support Application Metadata user management?
Gluu supports Application Metadata user management. Custom client attributes configurable via the Config API/TUI. Read more
Does Gluu support User Search user management?
Gluu supports User Search user management. User search via SCIM 2.0 filter queries. Read more
Does Gluu support Role-Based Access Control (RBAC) user management?
Gluu supports Role-Based Access Control (RBAC) user management. Role-based access via OAuth scopes and Cedarling Cedar policies. Read more
Does Gluu support Password Strength Policies user management?
Gluu supports Password Strength Policies user management. Read more
Does Gluu support Username Restrictions user management?
Gluu supports Username Restrictions user management. Read more
Does Gluu support Attribute-Based Access Control (ABAC) access control?
Gluu supports Attribute-Based Access Control (ABAC) access control. Cedarling is an embeddable Policy Decision Point built on the Rust Cedar engine, supporting attribute-based access control policies. Read more
Does Gluu support Fine-Grained Authorization (FGA / ReBAC) access control?
Gluu supports Fine-Grained Authorization (FGA / ReBAC) access control. Cedarling delivers fine-grained authorization decisions in under 50 microseconds, embeddable client- or server-side. Read more
Does Gluu support API Authorization (Scopes / Permissions) access control?
Gluu supports API Authorization (Scopes / Permissions) access control. OAuth 2.0 scopes and UMA 2.0 for centralized API/resource access management, a founding use case of the platform. Read more
Does Gluu support Audit Log Retention security feature?
Gluu supports Audit Log Retention security feature. Server and authorization decision logging; retention is operator-configured. Read more
Does Gluu support Audit Log Streaming security feature?
Gluu supports Audit Log Streaming security feature. Cedarling decision logs can be connected to ITDR/SIEM platforms for real-time monitoring. Read more
Does Gluu support Security Center (Threat Monitoring Dashboard) security feature?
Gluu does not support Security Center (Threat Monitoring Dashboard) security feature.
Does Gluu support Encryption at Rest security feature?
Gluu partially supports Encryption at Rest security feature. Depends on the configured persistence backend's own encryption-at-rest support; not a built-in Janssen feature.
Does Gluu support Encryption in Transit security feature?
Gluu supports Encryption in Transit security feature. TLS enforced for all endpoints; mutual TLS supported for client authentication. Read more
Does Gluu support Customer Managed Keys (BYOK) security feature?
Gluu supports Customer Managed Keys (BYOK) security feature. Full key management control via self-hosted deployment. Read more
Does Gluu support Brute Force Protection security feature?
Gluu supports Brute Force Protection security feature. Account lockout and rate-limiting configuration for authentication endpoints. Read more
Does Gluu support Suspicious IP Throttling security feature?
Gluu partially supports Suspicious IP Throttling security feature. Rate limiting configurable at the endpoint level; no dedicated IP-reputation engine documented.
Does Gluu support Per-Organization Branding multi-tenancy?
Gluu partially supports Per-Organization Branding multi-tenancy. Login page and templates are customizable per deployment; no multi-organization branding model.
Does Gluu support Per-Organization MFA Policy multi-tenancy?
Gluu partially supports Per-Organization MFA Policy multi-tenancy. MFA/ACR policy configurable per client via scopes and interception scripts; not scoped to a multi-org model.
Does Gluu support Hosted / Universal Login Page branding feature?
Gluu supports Hosted / Universal Login Page branding feature. Read more
Does Gluu support White-Label / Full Brand Removal branding feature?
Gluu supports White-Label / Full Brand Removal branding feature. Login pages, Casa portal, and email templates are fully themeable. Read more
Does Gluu support Localization / i18n branding feature?
Gluu supports Localization / i18n branding feature. Multi-language login pages and email templates. Read more
Does Gluu support Prebuilt UI Components (SDK) branding feature?
Gluu partially supports Prebuilt UI Components (SDK) branding feature. Casa provides a prebuilt self-service UI; no separate general-purpose UI component library. Read more
Does Gluu support Login / Auth Analytics Dashboard analytics?
Gluu partially supports Login / Auth Analytics Dashboard analytics. Structured audit/decision logs feed external SIEM/ITDR tools; no built-in analytics dashboard.
Does Gluu support GDPR: Data Export (Portability) compliance?
Gluu supports GDPR: Data Export (Portability) compliance. User data export via the SCIM 2.0 API. Read more
Does Gluu support GDPR: Right to be Forgotten (User Deletion) compliance?
Gluu supports GDPR: Right to be Forgotten (User Deletion) compliance. User deletion via SCIM DELETE. Read more
Does Gluu support Consent Management compliance?
Gluu supports Consent Management compliance. OAuth 2.0 consent screen plus post-authentication consent workflows configurable via Agama. Read more
Does Gluu support Region Deployment compliance?
Gluu supports Region Deployment compliance. Self-hosted deployment in any region; Flex hosting supports multiple geographic locations per plan. Read more
Does Gluu support Private Cloud Deployment compliance?
Gluu supports Private Cloud Deployment compliance. Self-hosted via VM installers, Docker, or Helm charts for Kubernetes. Read more
Does Gluu support SDK Coverage developer integration?
Gluu supports SDK Coverage developer integration. jans-client libraries plus Cedarling SDKs (Rust core with WASM, Python, Java, and mobile bindings). Read more
Does Gluu support Management API developer integration?
Gluu supports Management API developer integration. Config REST API, CLI, and Text-based UI (TUI) for server configuration and client management. Read more
Does Gluu support Authentication API Rate Limits developer integration?
Gluu partially supports Authentication API Rate Limits developer integration. Rate limiting configurable per endpoint; no dedicated per-tenant quota system.
Does Gluu support Actions / Extensibility Pipeline developer integration?
Gluu supports Actions / Extensibility Pipeline developer integration. Interception scripts (Python/Java via Jython) and Agama low-code flows for custom authentication and authorization logic. Read more
Does Gluu support TypeScript Support in Extensibility developer integration?
Gluu does not support TypeScript Support in Extensibility developer integration. Custom logic is written in Python/Java (interception scripts) or the Agama DSL, not TypeScript/JavaScript.
Does Gluu support Custom Domain developer integration?
Gluu supports Custom Domain developer integration. Self-hosted deployment supports any custom domain. Read more
Does Gluu support Deploy CLI (Infrastructure as Code) developer integration?
Gluu supports Deploy CLI (Infrastructure as Code) developer integration. Janssen CLI and Text-based UI (TUI) for scripted configuration; Helm charts for Kubernetes CI/CD. Read more
Does Gluu support Terraform Provider developer integration?
Gluu supports Terraform Provider developer integration. Official JanssenProject/terraform-provider-jans manages auth server configuration, clients, scopes, users, and scripts as code. Read more
Does Gluu support Custom Database Connections developer integration?
Gluu supports Custom Database Connections developer integration. Pluggable persistence layer supports LDAP, MySQL, PostgreSQL, Couchbase, and Spanner, including hybrid combinations per data category. Read more
Does Gluu support Universal Login / Hosted Login Page Customization developer integration?
Gluu supports Universal Login / Hosted Login Page Customization developer integration. Full HTML/CSS customization of the hosted login pages. Read more
Does Gluu support Custom Email Provider (SMTP) developer integration?
Gluu supports Custom Email Provider (SMTP) developer integration. Configurable SMTP server for outbound notifications. Read more
Does Gluu support Email Templates developer integration?
Gluu supports Email Templates developer integration. Read more
Does Gluu support Custom OIDC Claims / Token Enrichment developer integration?
Gluu supports Custom OIDC Claims / Token Enrichment developer integration. Custom scopes and claims via dynamic scopes and interception scripts. Read more
Does Gluu support No-Code Auth Flow Builder / Orchestration feature?
Gluu supports No-Code Auth Flow Builder / Orchestration feature. Agama Lab provides a drag-and-drop designer for building multi-step, multi-factor authentication workflows without coding. Read more
Does Gluu support Built-in Billing / Subscription Management feature?
Gluu does not support Built-in Billing / Subscription Management feature.
Does Gluu support Agentic AI / MCP Server Authentication feature?
Gluu supports Agentic AI / MCP Server Authentication feature. Gluu Flex mints scoped JWTs for both workload and person identity, and Cedarling is positioned for AI agent authorization decisions as part of a Token-Based Access Control (TBAC) model. Read more
Does Gluu support Post-Quantum Hybrid TLS Key Exchange post-quantum cryptography feature?
Gluu does not support Post-Quantum Hybrid TLS Key Exchange post-quantum cryptography feature. The Janssen auth-server (Gluu's open-source successor) runs on Java. Java's own hybrid PQC TLS 1.3 support (JEP 527) only reached JDK 27 early-access builds in 2026 and is not yet GA; even once available it would be a JVM/runtime capability, not a documented Janssen/Gluu vendor feature, and TLS termination is typically handled by an operator-controlled reverse proxy in front of the auth server. Read more
Does Gluu support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Gluu does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. No PQC JWA signing support is shipped. There is one open GitHub feature request in the Janssen Project repo (issue #14253, 'enable post quantum algorithms on AS', milestone 2.6.0), but it has no linked PR, no specified algorithms, and is unimplemented. Read more
Does Gluu support Post-Quantum Migration Roadmap post-quantum cryptography feature?
Gluu partially supports Post-Quantum Migration Roadmap post-quantum cryptography feature. The only public roadmap signal is GitHub issue #14253 in JanssenProject/jans, an open, milestone-tagged (2.6.0) feature request to enable post-quantum algorithms on the Auth Server. This is a maintainer-filed backlog item, not a published roadmap document, blog post, or whitepaper; no timeline or algorithm scope has been disclosed. Read more
Does Gluu support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Gluu does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No public evidence found that the provider supports ML-KEM or HPKE (RFC 9180) for encrypting JWE tokens, SAML assertions, or user secrets.
Does Gluu support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Gluu does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No public evidence found of post-quantum or hybrid X.509 digital certificate support for mTLS client authentication or federation endpoints.
Does Gluu support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Gluu does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No public evidence found of NIST SP 800-208 stateful hash-based signature scheme support (LMS/HSS, XMSS).
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.