Core Capabilities
On this page
Curity supplies a comprehensive identity and API access management software. Built on principles of separation of concerns, extensibility, and reliability, the Curity Identity Server provides organizations with a flexible and powerful toolbox for securing their applications, APIs, and user interactions at scale.
This article provides an overview of the product, its capabilities and features.
What is the Curity Identity Server?
The Curity Identity Server is a standards-based product that authenticates users, applications and services, manages identity data, and enables APIs to protect enterprise data. It is built on open standards, so applications and APIs integrate once. This allows for security policies to change without requiring code changes. The software runs in a customer-controlled environment, on-premise and in the cloud.
What Does the Curity Identity Server do?
The Curity Identity Server provides a central authentication and token service for users, applications, APIs, services and AI agents. It issues and validates OAuth 2.0 access tokens and OpenID Connect ID tokens, enables authorization at the API and AI gateways, connects to various identity stores and identity providers, and supports federation and token exchange across identity domains.
Following the principal of separation, the Curity Identity Server implements its different capabilities in services (also called profiles). The three base profiles are user authentication, token issuance and user management. The SAML Identity Provider Service and Application Service complement the base profiles with additional functionality.
| Component | Purpose |
|---|---|
| Authentication Service | Verifies users and produces the authenticated session used for single sign-on. |
| Token Service | Issues and validates the OAuth 2.0 and OpenID Connect tokens that protect applications and APIs. |
| User Management Service | Provisions and manages users, groups and credentials over standard APIs. |
| SAML Identity Provider Service | Acts as a SAML 2.0 identity provider alongside OpenID Connect. |
| Application Service | Creates and manages the applications that extend the Curity Identity Server. |
Authentication Service
The Authentication Service verifies users and produces an authenticated session that serves for single sign-on. Authentication is configured per client and use case, so different applications can require different methods and levels of assurance. After credentials are verified, a single action or a whole workflow can run, with or without user interaction.
| Capability | Description |
|---|---|
| Multiple Authentication Methods | A wide range of built-in methods (authenticators), including BankID, username and password (HTML Forms), email and SMS one-time codes, Passkeys, Mutual TLS, Duo, Entrust, verifiable credentials, social logins such as Google, Facebook and Sign in with Apple, and federation with external OpenID Connect, SAML 2.0 and PingFederate identity providers. Custom methods can be built with the SDK. |
| Authentication Actions | Orchestrate what happens after credentials are verified and before the session is established. Actions run in a set order, can be chained, look up data, prompt the user for more information, transform attributes, or apply custom rules. They are arranged in a visual workflow. |
| Login, Sessions and Single Sign-on | Authenticated session as the result of a login. Applications that share the same authentication requirements can reuse the session using single sign-on. Sessions can end when the browser closes, be persisted in a database, and use their own timeouts. |
| User Self-service | Let users register, reset a password, or update account details during login. Changes are written back to the user repository. |
| Step-up Authentication | Automatically or explicitly trigger stronger authentication before a sensitive operation, on top of an existing session. |
| Federation and Interoperability | Authenticate with external identity providers, applications, service providers and relying parties through the Curity Identity Server. |
| Account Linking | Link accounts that a user holds in different sources, e.g. identity providers, so they resolve to a single identity. |
| Single Logout | Log users out across the applications that share a session. |
| No-code Designer for Authentication Flows | A graphical interface that lets you customize the prerequisites, steps and actions for each authentication method through visual elements. This enables organization to set up an authentication journey that fits their needs and policies without writing code. |
| App Login (HAAPI) | Build login flows directly inside mobile and web applications with the Hypermedia Authentication API (HAAPI), keeping the security logic on the server. |
Token Service
The Token Service is the OAuth 2.0 Authorization Server and OpenID Connect Provider. It generates and manages security tokens that control access to APIs and applications in standards-based manner, catering to basic as well as high-security requirements. It controls what each token contains and how long it is valid. The APIs rely on these tokens to make authorization decisions.
| Capability | Description |
|---|---|
| Delegated Authorization and Token Issuance | Handle the issuance, validation, renewal, introspection and revocation of security tokens in accordance with configured policy. The Curity Identity Server can adapt the content, scope and duration of such tokens. Revoking a token withdraws the access it represents. |
| Fine-grained Access Control | Take into consideration human and non-human identity, delegation, contextual and risk-related information when crafting security tokens and granting access. |
| Consent and Delegation | Present a consent step so a user can approve what an application may do on their behalf, and allow that consent to be withdrawn later. |
| Granted Authorizations | View or manage the authorizations users have granted through a GraphQL API. |
| Grant Types and Flows | All common OAuth flows, including authorization code with PKCE, client credentials, refresh token, device authorization for input-constrained devices, and token exchange between domains. OpenID Connect hybrid flows are supported where enabled, and Client-Initiated Backchannel Authentication (CIBA) is available with the Financial API Package. |
| Token Procedures | Tailor the content and format of issued tokens for each flow, using server-side procedures. |
| Token Privacy (Phantom Token) | Issue opaque tokens outside the perimeter and exchange them for a JWT at the gateway through introspection, to not expose token contents externally. |
| Clients | Register and manage OAuth clients, with control over the grant types and token operations each client is allowed. |
| Database Clients | Store clients in a data source and manage them through a GraphQL API or the DevOps Dashboard, which suits large numbers of clients and organizations with many teams. |
| Dynamic Client Registration | Let applications and gateways register clients through the standard registration API or an equivalent GraphQL API, with template clients to share common settings. |
| Ephemeral Clients | Support for Client ID Metadata Document for non-persistent client configuration. Common for AI agent and Model Context Protocol (MCP) use cases. |
| Client Authentication | Authenticate clients with a shared secret, a signed JWT using the client's private key, a workload identity, or through mutual TLS. |
SAML Identity Provider Service
The SAML Identity Provider Service enables the Curity Identity Server to act as a SAML 2.0 identity provider for applications that use SAML, alongside OpenID Connect. This means the Curity Identity Server can issue SAML assertions to some applications and tokens to others. This is useful when older and newer applications run side by side. It allows, for example, for changing one application after the other during a migration.
User Management Service
The User Management Service of the Curity Identity Server centers around API-driven access to user data. Curity ships out-of-the-box interfaces on top of these APIs to cover common requirements while keeping the choice for organizations to completely create their own interfaces and flows.
| Capability | Description |
|---|---|
| Identity and Account Management | The Curity Identity Server offers graphical and programmatic interfaces for authorized systems and personnel to create, read, update and delete accounts and their attributes. |
| SCIM 2.0 API | Provision and manage users over the standard SCIM 2.0 Users endpoint, and manage groups over the SCIM 2.0 Groups endpoint. |
| GraphQL API | Manage users and related data programmatically, as an alternative to SCIM. |
| Access Control on the APIs | Restrict the management APIs by scope and by policy, including self-service access where a user may manage only their own data. |
| Groups and Access Decisions | Manage group membership, which authorization managers can use to make access decisions. |
| One Way to Manage Identities | Provide a consistent, standards-based way to manage user accounts and groups, rather than managing them separately in each application. |
| Credential Management | Manage credentials through a credential manager, apply password and credential policies, and migrate credentials from an existing store. |
| Registration and Verification | Support account registration and verification, for example by email or SMS. |
| User Self-service | The Curity Identity Server provides a self-service portal where users can manage their account data including authentication-related data such as email addresses, phone numbers, passwords and passkeys as well as multi-factor settings. |
| Open Data Model | The Curity Identity Server supports an open data model for identity data with custom user attributes and integrates with many different types of datastores. Enterprises can take full control over data residency, across regions and tenants if required. |
| Data Store Options | Integrate with existing identity repositories. Keep user data in LDAP, SQL (JDBC), SCIM, JSON/REST, DynamoDB or MongoDB. |
| Consent Management | User control over data sharing and privacy, giving granular permissions for what data to share with third parties. |
Application Service
Applications are plugins on top of the Curity Identity Server that leverage existing capabilities like token issuance and GraphQL APIs. Applications can, for example, provide a user interface like the Self-service portal for the GraphQL API. Another example of an application is the Token Handler, a Backend-for-Frontend (BFF) implementation for secure token handling in browser-based applications. The Application Service is used to create and manage these plugins.
Extensibility
The Curity Identity Server is built on extensibility principles, allowing customization without modifying core functionality.
| Capability | Description |
|---|---|
| Customized Authentication | Extension points targeting authentication let you customize steps in an authentication flow or even define complete, proprietary authentication methods. |
| Customized Authorization | Extension points targeting authorization let you customize the retrieval of data, construction and issuance of access tokens. They also allow for integrating with external services for authorization decisions. |
| Branded User Interfaces | User interfaces can be adapted and branded, even per application if required, supporting multiple brands under the same umbrella. |
| SDK | Curity ships a documented software development kit and extension interfaces permitting the configuration of supplied components and the development of additional integrations and customizations. |
| Management APIs | The Curity Identity Server exposes APIs for administrative tasks which allow you to to integrate with third-party, existing, new or custom portals like a common developer portal or custom self-service portal. |
Administration, Deployment and Operations
| Capability | Description |
|---|---|
| Configuration Management | The Curity Identity Server supports multiple interfaces to configure the product including a graphical interface, the Admin UI, a command line interface and APIs. It also supports loading the configuration from file upon startup for modern deployment flows. |
| DevOps Dashboard | The DevOps Dashboard gives developers and operators limited, delegated access without granting full administrative rights. It enables delegated client management where development teams manage their own OAuth clients. It provides operational visibility for operators to view alarms and details without full access to the Curity Identity Server. |
| Flexible Deployment | The Curity Identity Server is a cloud-native product, which means it runs on any modern cloud environment, including private clouds and on-premise installations. Deployments can span multiple regions and tenants when required, and ensure locality with your APIs. |
| High Availability | The Curity Identity Server can be deployed with multiple nodes. Metrics allow for monitoring the state of each node. Together with zero-downtime updates, this ensures high availability of the services. |
| Monitoring and Logging | The Curity Identity Server publishes metrics, events and logs that allow monitoring the system and integrate with Security Identity and Event Management (SIEM) systems to discover anomalies in real time. Alerts immediately notify when something appears broken and impacts the operation of the product. |
Summary
The Curity Identity Server provides a standards-based platform for identity and access management. Its core capabilities span authentication and session management, user management, authorization, and API security, all built on principles of extensibility and reliability.
For more detailed information on specific capabilities, explore the related articles on Authentication, Tokens, and High Availability.
Customer Stories
Learn how organizations run identity and API security at scale.
Read customer storiesWas this helpful?