Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
WSO2 Identity Server is an open-source identity and access management platform running on the JVM, implementing OAuth 2.0, OpenID Connect, SAML 2.0 and SCIM 2.0. This Lynxroute build is hardened and ready out of the box: no administrator password baked into the image, a fresh signing keystore generated at first launch to replace the publicly known default, plain HTTP disabled so only TLS is served, TLS restricted to 1.2 and 1.3, PostgreSQL bound to 127.0.0.1 only, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
Apache-2.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS WSO2 IDENTITY SERVER
WSO2 Identity Server is an open-source identity and access management platform that issues and validates tokens for your applications and APIs and centralises how users sign in across them. It runs as a single Java server on Eclipse Temurin 21 and implements OAuth 2.0 and OpenID Connect, SAML 2.0, SCIM 2.0 user provisioning and OIDC front-channel logout, with multi-factor and adaptive authentication, passwordless and social login, B2B organisation management, and self-service registration and password recovery. It federates with external identity providers and can read users from LDAP or Active Directory. This image persists identity, consent, registry and agent data in a bundled PostgreSQL instance, and ships a browser admin console plus a separate My Account portal for end users. Apache-2.0 license, no vendor lock-in. Running your own identity server keeps every login, token and user attribute inside your own AWS account, priced per instance rather than per monthly active user.
WHAT THIS AMI ADDS
Security hardening:
- No administrator password is baked into the image - a random super-admin credential is generated at first launch and written to a root-only file
- The signing keystore is regenerated at first launch, replacing the publicly known default key that ships with the distribution, with subject alternative names covering every access path
- The truststore password is rotated off the published default value
- The internal application credential that ships with the distribution, and its published hash, are both replaced at first launch
- Plain HTTP transport is disabled - only the TLS port serves traffic and only that port is opened in the firewall
- TLS restricted to 1.2 and 1.3; client-initiated TLS renegotiation rejected; the HTTP response header no longer advertises the underlying server stack
- PostgreSQL bound to 127.0.0.1 only, never exposed off the instance
- UFW firewall pre-configured - TCP 9443 and SSH 22 only
- fail2ban and AppArmor pre-configured
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- WSO2 Identity Server security baked in: no administrator password in the image (a random one is generated at first launch), signing keystore regenerated to replace the publicly known default, plain HTTP disabled so only TLS is served, TLS restricted to 1.2 and 1.3, PostgreSQL bound to 127.0.0.1 only.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Standards-based single sign-on for your own applications: OAuth 2.0, OpenID Connect, SAML 2.0, SCIM 2.0 provisioning, multi-factor and adaptive authentication, B2B organisations. Apache-2.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
m6i.xlarge Recommended | $0.05 |
t3.large | $0.03 |
m6i.2xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour based on the EC2 instance size you launch. All four options run the same hardened Identity Server image, so pricing scales with compute capacity, not features. The t3.large and m6i.large give you smaller compute footprints. The m6i.xlarge and m6i.2xlarge give you more CPU and memory for heavier workloads. Software charges accrue per hour, and you add the underlying AWS infrastructure cost separately. Choose the instance size that matches your expected load, and change it later as your needs shift.
Top-of-mind questions for buyers
Each option launches a hardened Ubuntu 24.04 LTS image running WSO2 Identity Server. Every instance ships with CIS Level 1 hardening, CVE scanning, a CycloneDX SBOM, a CIS Conformance Report, and unique credentials generated at first boot. The instance size sets the CPU and memory you get.
Software charges accrue per hour while the instance runs. A fully stopped instance does not accrue hourly software charges. Stopped instances may still incur underlying AWS storage fees for attached volumes. The software licence meters running time only.
Yes. All four options run the same image, so you can resize between t3.large, m6i.large, m6i.xlarge, and m6i.2xlarge as your load changes. Your hourly software rate then follows the new instance size. Any change is made manually through your AWS console.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
WSO2 Identity Server 7.3.0 - Initial release (August 2026)
- WSO2 Identity Server 7.3.0 on Ubuntu 24.04 LTS, Eclipse Temurin 21
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- Production datastore on a bundled local PostgreSQL (identity, shared and agent databases); the embedded H2 development database is not used
- No administrator password baked into the image - a random super-admin credential is generated at first launch
- Signing keystore regenerated at first launch, replacing the publicly known default that ships with the distribution; truststore password rotated off its published default
- Internal application credential and its published hash both replaced at first launch
- Plain HTTP transport disabled - HTTPS only; TLS restricted to 1.2 and 1.3
- PostgreSQL bound to localhost
- UFW firewall pre-configured (22, 9443)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (m6i.xlarge recommended; 4 vCPU and 4 GB RAM is the vendor minimum)
- Open Security Group - allow TCP 9443 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/wso2is-credentials.txt
- Open https://<PUBLIC_IP>:9443/console in your browser - accept the self-signed certificate warning
- Log in as admin with the password from the credentials file
- Create your own administrator, then disable or change the generated account
- End users sign in at https://<PUBLIC_IP>:9443/myaccount to manage their profile, sessions and multi-factor enrolments
The administrator password is generated on this instance at first launch and is unique to it; no password is baked into the image. Allow two to four minutes after launch for the identity server to finish starting before the console answers.
Credentials are saved to /root/wso2is-credentials.txt.
Standard endpoints, all on port 9443: OpenID Connect discovery at /oauth2/token/.well-known/openid-configuration, JWKS at /oauth2/jwks, SCIM 2.0 at /scim2/Users, token endpoint at /oauth2/token.
On sign-in the browser is redirected to this instance's configured server hostname, which is its public DNS name. That is expected.
Plain HTTP on port 9763 is disabled in this image; only TLS on 9443 is served.
Replace the self-signed TLS certificate with a CA-signed certificate for production use, then update the keystore settings and the server hostname in /opt/wso2is/repository/conf/deployment.toml and restart with: sudo systemctl restart wso2is
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For WSO2 Identity Server documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
WSO2 API Manager is an industry-leading full lifecycle API management platform for building, integrating, securing, and exposing an enterprise's digital services as managed APIs in cloud, on-premises, and hybrid architectures. Fast-track your API strategy with all the capabilities needed by API designers, product managers, operations, and consumers.
WSO2 Identity Server is a powerful, modern identity and access management solution for your on-premises or cloud environment. It enables organizations to deliver exceptional, trusted digital experiences to all types of users: internal workforce, external consumers, business customers or API consumers. Preferred by customer reviewers over Okta, WSO2 Identity Server offers a more compelling technical direction, better feature updates, and superior support quality.
WSO2 Private Identity Cloud is an individual, secure SaaS instance of our AI-powered open source IAM suite, enabling secure access for every type of identity: B2C customers, B2B SaaS applications, workforce, and APIs.
OpenChoreo is a complete, open-source Internal Developer Platform (IDP) for Kubernetes. It provides reusable platform and developer abstractions as APIs, a Backstage-powered developer portal, built-in CI/CD, GitOps workflows, RBAC and observability. OpenChoreo is a CNCF project.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.