gluu.org

What It Is

Gluu’s page presents an identity and access management methodology around “ideal API security.” Its core idea is to protect API endpoints with OAuth scopes, combined with OpenID Connect, JWT, TLS, an authorization server, an API gateway, and an external PDP for authentication and authorization. Note that the captured content reads more like a technical blog post than a product page, so pricing, deployment, certification, and commercial support details are not disclosed.

Core Capabilities and Protection Types

The article breaks API security into three steps. First, during the API design stage, declare the OAuth security scheme through OpenAPI/Swagger and bind the required scopes to different HTTP methods and endpoints. Second, use software statements to restrict which scopes developers may request when registering clients, addressing the question of “who is trusted to call the API.” Third, at runtime, the authorization server issues tokens, while the API gateway validates JWTs or performs token introspection. Alternatively, access tokens and context can be passed to an external PDP for decision-making. The protection focus is API authentication, client identity, token issuance, scope-based authorization, and policy enforcement. It does not cover network perimeter protections such as WAF, DDoS mitigation, or vulnerability scanning.

Deployment, Management, and Integration

The article does not explain Gluu’s specific deployment model, but it mentions that Gluu Server has an interception script for token introspection, which can determine the scopes in a token based on context such as the request, client authorization, risky IPs, or fraud scores. From a management perspective, it emphasizes reducing authorization code inside applications from the design stage, and using a centralized PDP when there are many policies. Its integration approach is relatively clear: it can align with OAuth, OIDC, JWT, TLS, OpenAPI, API Gateway, and PDP concepts from Styra, Oso, Axiomatics, PlainID, and similar solutions.

Pricing and Target Users

The page does not provide pricing, payment methods, or plan information. Suitable users include enterprise security teams, API platform teams, open API ecosystem operators, and development teams that need fine-grained scope governance. The article also outlines an approach for scenarios such as open banking, where software statements are issued by regulators.

Pros, Cons, and Access from China

The strengths are its high degree of standardization and clearly layered architecture, which can decouple authentication, authorization, and runtime policy enforcement. The downside is that implementation complexity is not low, especially because software statements and PDPs require supporting processes and platforms. The article does not provide information about access from China, so domain connectivity, payment availability, and local alternatives cannot be confirmed. For deployment within Chinese enterprises, it may be worth evaluating local IAM, API gateway, or zero-trust access control solutions as alternatives.