Exploring the WSO2 Products and Service Stack
Thilan Dissanayaka WSO2 March 28, 2020

Exploring the WSO2 Products and Service Stack

WSO2 offers a comprehensive, open-source-first platform designed to simplify API management, integration, identity management, and cloud-native application development. Whether you’re building modern applications, securing APIs, or connecting distributed systems, WSO2 provides the tools to get you there efficiently. In this guide, we’ll explore the key components of the WSO2 ecosystem—including flagship products like API Manager, Micro Integrator, Identity Server, the developer-focused Ballerina language, and SaaS-based solutions like Choreo and Asgardeo. We’ll also touch on internal tools like Devant and Bijira, which support WSO2’s own engineering workflows.

WSO2 API Manager

A full lifecycle API management solution.

Purpose: To design, publish, secure, manage, and monitor APIs.

Key Features:

  • API Gateway for routing and throttling
  • Developer Portal for API discovery
  • API Publisher for managing API lifecycle
  • Built-in analytics (via Choreo or external)
  • Supports REST, GraphQL, WebSockets

Use Cases: Internal/external API exposure, monetization, federated API gateway models.

WSO2 Micro Integrator

A lightweight integration runtime based on the WSO2 Enterprise Integrator.

Purpose: Microservices-based integration for cloud-native applications.

Key Features:

Built on Apache Synapse

Supports mediation, transformation, and routing

Integrates with databases, SaaS, legacy systems

Container-friendly (Kubernetes/ Docker)

Use Cases: Building integration microservices, edge integrations, legacy modernization.

WSO2 Identity Server

An identity and access management (IAM) product.

Purpose: Provide SSO, federated login, access delegation, and user management.

Key Features:

Supports OAuth2, OIDC, SAML2, SCIM, FIDO2

MFA, adaptive authentication, consent management

User self-service portal

Integrates with LDAP, AD, JDBC

Use Cases: Customer IAM (CIAM), Workforce IAM, federated identity, secure access to apps/APIs.

Ballerina

An open-source cloud-native programming language.

Purpose: Simplify integration with a developer-friendly syntax.

Key Features:

Built-in support for network protocols (HTTP, gRPC, WebSockets)

Visual programming view

Concurrency with worker and isolated concepts

Data transformations and JSON/XML handling

Use Cases: Writing microservices, API backends, and integration logic.

Choreo

A cloud-native developer platform for APIs and integrations.

Purpose: Empower developers to build, deploy, and manage cloud-native applications faster.

Key Features:

No-code/low-code + pro-code development

Integrates APIs, Ballerina services, and connectors

Built-in CI/CD, observability, GitOps

Hosted or private cloud deployment

Use Cases: Rapid API/service development, serverless integration, digital transformation.

Asgardeo

A SaaS-based CIAM (Customer Identity and Access Management) platform.

Purpose: Secure customer access with modern identity standards and UX.

Key Features:

OAuth2, OIDC, SAML2 support

Social logins, passwordless auth, MFA

SDKs for SPA, mobile apps

User analytics, branding, adaptive authentication

Use Cases: Secure customer-facing apps with low integration effort.

Devant

An internal tool developed by WSO2 for managing engineering operations.

Purpose: Assist in developer productivity, workflow automation.

Status: Mostly used internally and not a commercial product.

Features: Integration with Jira, GitHub, CI/CD pipelines.

Bijira

A Jira clone built in-house by WSO2 for internal project and task management.

Purpose: Task tracking and issue management for WSO2 teams.

Status: Not publicly available, for internal use only.

Note: Useful for testing internal tooling capabilities and integration scenarios.

ALSO READ
Blockchain 0x000 – Understanding the Fundamentals
May 21, 2020 Web3 Development

Imagine a world where strangers can exchange money, share data, or execute agreements without ever needing to trust a central authority. No banks, no intermediaries, no single point of failure yet...

Identity and Access Management (IAM)
May 11, 2020 Identity & Access Management

Who are you — and what are you allowed to do? That's the fundamental question every secure system must answer. And it's exactly what Identity and Access Management (IAM) is built to solve.

How I built a web based CPU Simulator
May 07, 2020 Pet Projects

As someone passionate about computer engineering, reverse engineering, and system internals, I've always been fascinated by what happens "under the hood" of a computer. This curiosity led me to...

Writing a Shell Code for Linux
Apr 21, 2020 Exploit Development

Shellcode is a small piece of machine code used as the payload in exploit development. In this post, we write Linux shellcode from scratch — starting with a simple exit, building up to spawning a shell, and explaining every decision along the way.

Exploiting a Stack Buffer Overflow on Windows
Apr 12, 2020 Exploit Development

In a previous tutorial we discusses how we can exploit a buffer overflow vulnerability on a Linux machine. I wen through all theories in depth and explained each step. Now today we are going to jump...

Access Control Models
Apr 08, 2020 Identity & Access Management

Access control is one of the most fundamental concepts in security. Every time you set file permissions, assign user roles, or restrict access to a resource, you're implementing some form of access control. But not all access control is created equal...

Exploiting a  Stack Buffer Overflow  on Linux
Apr 01, 2020 Exploit Development

Have you ever wondered how attackers gain control over remote servers? How do they just run some exploit and compromise a computer? If we dive into the actual context, there is no magic happening....

Basic concepts of Cryptography
Mar 01, 2020 Cryptography

Ever notice that little padlock icon in your browser's address bar? That's cryptography working silently in the background, protecting everything you do online. Whether you're sending an email,...

Common Web Application Attacks
Feb 05, 2020 Application Security

Web applications are one of the most targeted surfaces by attackers. This is primarily because they are accessible over the internet, making them exposed and potentially vulnerable. Since these...

Remote Code Execution (RCE)
Jan 02, 2020 Application Security

Remote Code Execution (RCE) is the holy grail of application security vulnerabilities. It allows an attacker to execute arbitrary code on a remote server — and the consequences are as bad as it sounds. In this post, we'll go deep into RCE across multiple languages, including PHP, Java, Python, and Node.js.