About

I’m Sagara Gunathunga, an identity architect with over 15 years of experience in identity, integration, and application development. I’m passionate about making complex identity protocols practical and accessible for developers. On this blog I write about OAuth, OpenID Connect, MCP, and AI agent identity, from the specs down to working implementations.

I’m the author of Hands-On Spring 6 and I maintain ThunderID, an open-source project at the OpenWallet Foundation. I’m the Head of DevRel at WSO2 IAM, and I’ve spoken at major industry events.

I’m also a long-standing contributor to the Apache Software Foundation as a Committer and PMC Member across projects such as Apache Axis2, Apache Synapse, and Apache Camel, and I was elected VP of the Apache Web Services project in 2012.

He is always open to discussing the future of identity, developer experience, and AI.

• LinkedIn: /in/ssagara
• X: @sagaras
• GitHub: @sagara-gunathunga
• Medium: sagarag.medium.com
• Mail: sagaragu@gmail.com

Conferences (Speaker)

• apidays Australia - (2026, Melbourne, Australia)
• Agentic Engineering Day NZ - (2026, Auckland, New Zealand)
• WSO2Con Europe - (2025, Barcelona, Spain)
• European Identity & Cloud Conference - (2019, Munich, Germany)
• WSO2 Summit Sydney- (2019, Sydney, Australia)
• Consumer Identity World APAC - (2018, Singapore)
• WSO2Con Europe- (2018, London, UK)
• Consumer Identity World EUROPE -(2018, Amsterdam, Netherlands)
• Consent and Identity Management, Kantara Panel Discussion - ([2018] Amsterdam, Netherlands)
• WSO2Con Asia - (2018, Colombo, Sri Lanka)
• GDPR Summit - (2018, London, UK)
• WSO2Con Asia - (2018, Colombo, Sri Lanka)
• WSO2Con Asia - (2016, Colombo, Sri Lanka)
• WSO2Con Europe - (2016, London, UK)
• WSO2Con USA - (2015, San Francisco, USA)
• WSO2Con Europe - (2014, Barcelona, Spain)
• ApacheCon NA - 2011, Vancouver, Canada)
• Apache Roadshow 2009 - Colombo, Sri Lanka - (2009, Colombo, Sri Lanka)
• IEEE Industrial and Information Systems - (2007, Kandy, Sri Lanka)

Meetups / Community Events (Speaker)

• Cloud Native Integration Auckland Meetup - New Zealand - Microservices Security landscape

• Cloud Native Integration Wellington Meetup - New Zealand - Microservices Security landscape

• Meetup: WSO2 London Meetup - The UK, Topic - GDPR, Optimizing Your Strategy with Identity and Access Management

• JAVA Colombo Meetup - Sri Lanka, Topic: Building Microservices with MSF4J-Spring

• JAVA Colombo Meetup - Sri Lanka, Topic: Deep dive into JAX-RS

• WSO2 Colombo Meetup - Sri Lanka, Topic: JavaEE and RESTful development

• Apache BarCamp 2012 Colombo - Sri Lanka, Topic: Contributing to Apache

• Apache Meet Up 2012, Kandy - Sri Lanka, Topic: Contributing to Apache

Articles (Author)

• Why Quantum-Safe IAM Demands Immediate Action Link

• Why MCP matters – and how to secure it Link

• Real-World Security Considerations for MCP Link

• Quantum-Safe IAM: Why Do You Need to Act Today? Link

• UMA 2 in Action Part 1 Part 2

• Seven steps for GDPR compliance Link

• CIAM: The Future of the (Digital) Enterprise Part 1 Part 2

• Defining a Winning GDPR Strategy - Introduction to GDPR Link

• Defining a Winning GDPR Strategy - 7 Steps for GDPR Compliance Link

• Defining a Winning GDPR Strategy - Identity and Access Management to the Rescue Link

• Defining a Winning GDPR Strategy - GDPR Compliant Consent Design Link