Identity Server tables (3.x)¶

APIM 3.x embeds WSO2 Identity Server so that it can act as a key manager and handle logins. With that comes a large set of Identity Server tables, plus the remaining registry and user-management tables. APIM's own flows barely touch them, so this page gives one line per table. Each name links to its full column list.

Which identity tables are core?

The identity tables APIM relies on (OAuth clients, tokens, scopes, service providers, users, roles and the main registry tables) are explained in full on the domain pages: Keys & tokens, Scopes, Tenants & users and Registry.

IDN_* — authentication sessions¶

Login sessions for the portals and single sign-on. Used during login, never during API calls.

IDN_AUTH_SESSION_STORE¶

Serialized authentication session objects (SSO session context), keyed by session id and type. Columns

IDN_AUTH_TEMP_SESSION_STORE¶

Short-lived session data kept only while a multi-step login is in progress. Columns

IDN_AUTH_USER¶

A user who has an active SSO session: id, name, tenant, user-store domain and identity provider. Columns

IDN_AUTH_USER_SESSION_MAPPING¶

Links an authenticated user (IDN_AUTH_USER) to their session ids. Columns

IDN_AUTH_SESSION_APP_INFO¶

Which service providers (apps) a session has logged in to, and the subject used for each. Columns

IDN_AUTH_SESSION_META_DATA¶

Name–value metadata of a session, e.g. last access time, IP address and user agent. Columns

IDN_AUTH_WAIT_STATUS¶

Tracks logins that are paused waiting for an external step, e.g. a long-wait or asynchronous authenticator. Columns

IDN_FED_AUTH_SESSION_MAPPING¶

Maps a federated identity provider's session index to the local session, for federated logout. Columns

IDN_* — OAuth extras¶

OAuth and OIDC features that APIM applications rarely use. The main OAuth tables are on Keys & tokens and Scopes.

IDN_OAUTH1A_REQUEST_TOKEN¶

OAuth 1.0a request tokens (legacy protocol). Columns

IDN_OAUTH1A_ACCESS_TOKEN¶

OAuth 1.0a access tokens (legacy protocol). Columns

IDN_OAUTH2_SCOPE_VALIDATORS¶

Which scope validators (e.g. role-based, XACML) an OAuth client uses. FK to IDN_OAUTH_CONSUMER_APPS. Columns

IDN_OAUTH2_CIBA_AUTH_CODE¶

Requests in the Client-Initiated Backchannel Authentication (CIBA) grant. Columns

IDN_OAUTH2_CIBA_REQUEST_SCOPES¶

Scopes requested in a CIBA request. Columns

IDN_OAUTH2_DEVICE_FLOW¶

Requests in the device authorization grant (device code, user code, status). Columns

IDN_OAUTH2_DEVICE_FLOW_SCOPES¶

Scopes requested in a device-flow request. Columns

IDN_OIDC_JTI¶

Token ids (jti) of JWTs already used, e.g. JWT bearer grants or private-key-JWT client authentication, to stop replay. Columns

IDN_OIDC_PROPERTY¶

OIDC settings of an OAuth client, e.g. the ID token audience and encryption options, as name–value pairs. Columns

IDN_OIDC_REQ_OBJECT_REFERENCE¶

An OIDC request object sent with an authorize request, linked to its code or token. Columns

IDN_OIDC_REQ_OBJECT_CLAIMS¶

Claims requested inside an OIDC request object. Columns

IDN_OIDC_REQ_OBJ_CLAIM_VALUES¶

Allowed values for a claim requested in an OIDC request object. Columns

IDN_OIDC_SCOPE_CLAIM_MAPPING¶

Which user claims each OIDC scope (e.g. email, profile) releases in ID tokens. Columns

IDN_STS_STORE¶

Tokens issued by the WS-Trust Security Token Service (SOAP). Not used by APIM APIs. Columns

IDN_* — OpenID 2.0 & SAML¶

Stores for older single sign-on protocols.

IDN_OPENID_ASSOCIATIONS¶

OpenID 2.0 associations (shared secrets with relying parties). Columns

IDN_OPENID_REMEMBER_ME¶

OpenID 2.0 "remember me" cookies. Columns

IDN_OPENID_USER_RPS¶

OpenID 2.0 relying parties each user has trusted. Columns

IDN_SAML2_ARTIFACT_STORE¶

SAML 2.0 artifacts waiting to be resolved (artifact binding). Columns

IDN_SAML2_ASSERTION_STORE¶

Issued SAML 2.0 assertions, kept for query and logout. Columns

IDN_* — UMA¶

User-Managed Access 2.0: resource owners sharing protected resources. Not used by APIM out of the box.

IDN_UMA_RESOURCE¶

A registered UMA protected resource. Columns

IDN_UMA_RESOURCE_META_DATA¶

Name–value metadata of a UMA resource. Columns

IDN_UMA_RESOURCE_SCOPE¶

Scopes defined on a UMA resource. Columns

IDN_UMA_PERMISSION_TICKET¶

A UMA permission ticket issued to a client. Columns

IDN_UMA_PT_RESOURCE¶

Which resources a permission ticket covers. Columns

IDN_UMA_PT_RESOURCE_SCOPE¶

Which scopes of those resources a permission ticket covers. Columns

IDN_* — users, claims & identity data¶

User-related features of Identity Server: claims, account recovery and self-service.

IDN_BASE_TABLE¶

A marker table with one row (WSO2 Identity Server), used to detect whether the schema exists. Columns

IDN_CLAIM_DIALECT¶

A claim dialect (namespace), e.g. http://wso2.org/claims or the SCIM and OIDC dialects. Columns

IDN_CLAIM¶

One claim URI within a dialect. Columns

IDN_CLAIM_MAPPED_ATTRIBUTE¶

Which user-store attribute a local claim maps to, per user-store domain. Columns

IDN_CLAIM_PROPERTY¶

Properties of a claim, e.g. display name, required, read-only. Columns

IDN_CLAIM_MAPPING¶

Maps an external-dialect claim to a local claim. Columns

IDN_IDENTITY_USER_DATA¶

Per-user identity attributes kept outside the user store, e.g. account locked, failed login attempts. Columns

IDN_IDENTITY_META_DATA¶

Per-user security metadata, e.g. used one-time codes. Columns

IDN_RECOVERY_DATA¶

Password-reset and account-confirmation codes sent to users. Columns

IDN_PASSWORD_HISTORY_DATA¶

Hashes of users' previous passwords, to stop them reusing one. Columns

IDN_ASSOCIATED_ID¶

Links a local user to their identity at a federated identity provider. Columns

IDN_USER_ACCOUNT_ASSOCIATION¶

Links several local user accounts that belong to the same person (account linking). Columns

IDN_SCIM_GROUP¶

SCIM attributes (id, created, location) of user-store groups. Columns

IDN_THRIFT_SESSION¶

Sessions for the Thrift-based authentication service (legacy). Columns

IDN_CERTIFICATE¶

Certificates stored by Identity Server, e.g. for service providers. Columns

IDN_FUNCTION_LIBRARY¶

Reusable JavaScript functions for adaptive authentication scripts. Columns

IDP_* — identity providers¶

External (federated) identity providers, e.g. Google or a corporate SAML IdP, that users can log in with, plus the resident IdP settings.

IDP¶

One identity provider: name, tenant, whether it's enabled, and its home realm. Columns

IDP_AUTHENTICATOR¶

An authenticator configured for an IdP, e.g. SAML SSO or OIDC. Columns

IDP_AUTHENTICATOR_PROPERTY¶

Settings of an IdP authenticator, e.g. client ID and endpoint URLs. Columns

IDP_METADATA¶

Name–value metadata of an IdP. Columns

IDP_CLAIM¶

Claims an IdP sends. Columns

IDP_CLAIM_MAPPING¶

Maps an IdP claim to a local claim. Columns

IDP_LOCAL_CLAIM¶

Local claims requested from an IdP, with default values. Columns

IDP_ROLE¶

Roles an IdP sends. Columns

IDP_ROLE_MAPPING¶

Maps an IdP role to a local role. Columns

IDP_PROVISIONING_CONFIG¶

Outbound provisioning connector configured for an IdP. Columns

IDP_PROV_CONFIG_PROPERTY¶

Settings of an IdP provisioning connector. Columns

IDP_PROVISIONING_ENTITY¶

Users and groups that were provisioned to an IdP, with the remote id. Columns

SP_* — service providers¶

Settings for Identity Server service providers. APIM creates one service provider per OAuth client. SP_APP and SP_INBOUND_AUTH are explained on Keys & tokens. The rest are mostly left at their defaults.

SP_AUTH_STEP¶

A step in a service provider's login flow (for multi-factor login). FK to SP_APP. Columns

SP_FEDERATED_IDP¶

Which identity providers and authenticators a login step can use. Columns

SP_REQ_PATH_AUTHENTICATOR¶

Request-path authenticators (e.g. Basic auth in the request) enabled for a service provider. Columns

SP_AUTH_SCRIPT¶

The adaptive authentication script of a service provider. Columns

SP_CLAIM_DIALECT¶

Which claim dialect a service provider uses. Columns

SP_CLAIM_MAPPING¶

Claims a service provider requests, and how they map to local claims. Columns

SP_ROLE_MAPPING¶

Maps local roles to service-provider roles. Columns

SP_PROVISIONING_CONNECTOR¶

Outbound provisioning connectors for a service provider. Columns

SP_METADATA¶

Name–value metadata of a service provider. Columns

SP_TEMPLATE¶

Reusable service-provider templates. Columns

Records of what personal data users agreed to share, and for what purpose (GDPR). The script seeds one DEFAULT purpose and purpose category.

CM_PII_CATEGORY¶

A category of personal data, e.g. email address. Columns

CM_PURPOSE¶

A purpose for collecting data, e.g. DEFAULT. Columns

CM_PURPOSE_CATEGORY¶

A group of purposes. Columns

CM_PURPOSE_PII_CAT_ASSOC¶

Which personal-data categories a purpose covers. Columns

CM_RECEIPT¶

A consent receipt: one user's consent record. Columns

CM_CONSENT_RECEIPT_PROPERTY¶

Extra properties of a consent receipt. Columns

CM_RECEIPT_SP_ASSOC¶

Which service provider a receipt is for. Columns

CM_SP_PURPOSE_ASSOC¶

Which purposes a receipt's service-provider entry covers. Columns

CM_SP_PURPOSE_PURPOSE_CAT_ASSC¶

Purpose categories attached to a receipt's service-provider purpose. Columns

CM_SP_PURPOSE_PII_CAT_ASSOC¶

Personal-data categories the user consented to for that purpose, with validity. Columns

FIDO — security keys¶

Registered hardware security keys for passwordless or second-factor login.

FIDO_DEVICE_STORE¶

Registered FIDO U2F devices per user. Columns

FIDO2 — security keys¶

Registered FIDO2/WebAuthn credentials.

FIDO2_DEVICE_STORE¶

Registered FIDO2/WebAuthn credentials per user: credential id, public key and signature count. Columns

REG_* — registry (other tables)¶

The main registry tables are on Registry. These hold history and social features.

REG_RESOURCE_HISTORY¶

Older versions of registry resources, with a REG_DELETED flag. It has the same columns as REG_RESOURCE. Columns

REG_CONTENT_HISTORY¶

Content of older resource versions. Columns

REG_COMMENT¶

Registry-level comments. APIM uses AM_API_COMMENTS instead. Columns

REG_RESOURCE_COMMENT¶

Links a registry comment to a resource. Columns

REG_RATING¶

Registry-level ratings. APIM uses AM_API_RATINGS instead. Columns

REG_RESOURCE_RATING¶

Links a registry rating to a resource. Columns

REG_SNAPSHOT¶

A checkpoint (snapshot) of a collection's resource versions. Columns

REG_LOG¶

Audit log of registry actions: path, user, action and time. Columns

REG_CLUSTER_LOCK¶

A lock row used so that only one node in a cluster runs a registry task at a time. Columns

UM_* — user management (other tables)¶

The main user and role tables are on Tenants & users. These cover permissions, claims, system users and user-store domains.

UM_DOMAIN¶

A user-store domain, e.g. PRIMARY or INTERNAL, per tenant. Referenced by hybrid-role and permission tables. Columns

UM_UUID_DOMAIN_MAPPER¶

Maps a user's unique id to their user-store domain. Columns

UM_PERMISSION¶

A permission resource path plus action, e.g. /permission/admin/manage/api/create with ui.execute. Columns

UM_ROLE_PERMISSION¶

Which roles have which permissions (allowed or denied). Columns

UM_USER_PERMISSION¶

Permissions granted directly to a user. Columns

UM_MODULE¶

Groups permissions into modules. Columns

UM_MODULE_ACTIONS¶

Actions available in a permission module. Columns

UM_USER_ATTRIBUTE¶

Claim values of a JDBC user, per profile, e.g. email and first name. Columns

UM_DIALECT¶

Claim dialects of the user store (legacy claim model). Columns

UM_CLAIM¶

Claims and their attribute mappings (legacy claim model). Columns

UM_CLAIM_BEHAVIOR¶

Per-profile claim behaviour, e.g. hidden or read-only (legacy claim model). Columns

UM_PROFILE_CONFIG¶

User profile configurations (legacy). Columns

UM_SYSTEM_USER¶

System users that aren't in the normal user store, e.g. wso2.system.user. Columns

UM_SYSTEM_ROLE¶

System roles. Columns

UM_SYSTEM_USER_ROLE¶

Which system users have which system roles. Columns

UM_SHARED_USER_ROLE¶

Role assignments across tenants (shared roles). Columns

UM_ACCOUNT_MAPPING¶

Links user accounts across tenants. It has the only FK to UM_TENANT. Columns

UM_HYBRID_REMEMBER_ME¶

"Remember me" tokens for portal logins. Columns