WSO2 contributes ThunderID to LF Decentralized Trust

WSO2 has contributed ThunderID, a next-generation open source identity and access management (IAM) project, to LF Decentralized Trust (LFDT). LFDT is the Linux Foundation's home for decentralized technologies and digital trust. We started ThunderID to rethink IAM from the ground up. Moving it to LFDT puts the project under open, neutral governance, so the community that depends on ThunderID can also help shape it.

The ThunderID project shared its side of the story in its announcement. This post covers WSO2's side: why we are making this contribution, and what it means for you if you use WSO2 identity products today.

What ThunderID is

ThunderID is an open source IAM project written in Go. It manages, authenticates, and authorizes humans, AI agents, and machines. Its design covers agent-native identity, built-in support for decentralized identity and verifiable credentials, crypto-agility for the post-quantum era, and a lightweight runtime you can configure through GitOps.

ThunderID 1.0 is available now. For the details, read the ThunderID introduction and the 1.0 release post.

Why WSO2 contributed ThunderID to LFDT

Identity is becoming shared infrastructure. National digital identity programs, wallets and verifiable credentials, and AI agents acting on behalf of people all depend on trust that crosses organizations and borders. That trust is stronger when it rests on a foundation that many organizations share and shape.

Neutral governance matters more as digital sovereignty becomes a priority for governments and regulated industries worldwide. It gives you confidence that the core of your identity stack stays open, transparent, and independent of any one company's roadmap. LFDT provides that governance, and related projects that ThunderID can grow with.

This follows how WSO2 has worked since its founding as an open source company. Contributing ThunderID to a foundation is the next step for a project we expect to support identity infrastructure for many years. It also opens ThunderID to wider community adoption and contribution.

What this means for WSO2 identity products

ThunderID is the foundation of WSO2's next-generation identity and access management product line. Contributing it to LFDT does not change how WSO2 supports you today.

Products in this next-generation line will benefit from the way ThunderID is designed. It was built with emerging agentic IAM requirements at its core, to better address the identity challenges of AI agents. The same design brings native support for decentralized identity and verifiable credentials, so you can adopt those workflows alongside your existing user journeys. On top of that, a generic orchestration engine lets you shape journeys for both administrators and end users. Underneath, a lightweight Go-based runtime needs less infrastructure, immutable, declarative runtimes keep your deployments reviewable, auditable, and repeatable, and a crypto-agile core makes you post-quantum ready from day one, with room to adapt as cryptographic standards change.

If you run WSO2 Identity Server on-premises: WSO2 will continue to support and develop the Java-based Identity Server product line. You will not have to migrate. When you are ready to move to ThunderID-based products, WSO2 will provide an opt-in migration path that runs on your timeline.

If you use WSO2 Identity Platform SaaS: your service will move to WSO2's ThunderID-based cloud service. WSO2 will manage the transition and keep you informed at each step.

If you need commercial support for ThunderID: you will have a smooth path to the next Identity Server product line, the commercially supported version built on ThunderID.

How WSO2 will keep investing in ThunderID

The move to LFDT changes who governs ThunderID, not how much WSO2 invests in it. WSO2 will continue to contribute to and help maintain the project, working through its open governance process alongside other contributors.

WSO2 will also keep building commercially supported and cloud products on ThunderID. You get an open, foundation-governed core, and WSO2 stands behind the products and services built on it.

Identity for humans, AI agents, and machines needs more than one company building it. We look forward to working on ThunderID with the LFDT community.

Next steps with WSO2 and ThunderID

• Review your plans with WSO2: talk to your WSO2 account team about what this means for your deployments.
• Try ThunderID and join the community: explore the ThunderID repository and join the conversations.