Wren:AM

Wren:AM is an open-source access management platform from the Wren Security suite. The platform acts as a central enforcement point for authentication and authorization decisions, enabling organizations to secure web applications, APIs, and microservices without modifying the protected resources themselves.

Core capabilities include:

• Adaptive authentication — risk-based, multi-factor, and step-up authentication with a modular authentication chain supporting OATH/TOTP, social login, and custom modules
• Single Sign-On (SSO) and Single Logout (SLO) — seamless session propagation across domains and applications; cross-domain SSO via federation or agent-based integration
• Federation — SAML 2.0 acting as Identity Provider or Service Provider; supports metadata exchange and signed/encrypted assertions
• OAuth 2.0 and OpenID Connect — authorization server issuing access tokens, refresh tokens, and ID tokens; supports authorization code, client credentials, device flow, and token exchange grants; PKCE and JWT profile support
• Fine-grained authorization — policy-based access decisions evaluating user attributes, session context, environment conditions, and resource attributes; REST-based policy evaluation API for external enforcement
• Session management — stateful and stateless (JWT) sessions with configurable token lifetimes, concurrent session limits, and session constraint enforcement
• REST and SOAP Security Token Service — issues, validates, and renews security tokens including SAML assertions, Kerberos tickets, and JWTs
• Multi-tenancy (realms) — hierarchical realm model allowing distinct authentication policies, identity stores, and federation configurations per business unit or customer
• Scripting and extensibility — Groovy and JavaScript hooks at authentication, authorization, and token issuance points for custom logic

Wren:AM is a full-featured identity provider and authorization server for an enterprise environment with thousands of protected resources.