A robust, enterprise-ready Identity Provider (IdP) built on .NET 10+ and OpenIddict, featuring a hybrid SSR (Razor Pages) and SPA (Vue.js) architecture.
Caution
SECURITY WARNING: This project includes default development passwords (e.g., YourStrong!Passw0rd). Never use these in production. Always use Environment Variables or a Secret Manager to override sensitive settings.
- Getting Started
- Architecture Guide
- Authentication Integration Boundary
- Identity Source and Field Mapping
- Neutral Non-login Query Contract 2.0
- Optional AuthProxy Integration Recipe
- Provider Proof Contract 1.0
- Provider API Capability Inventory
- Provider Native Profile 1.0 and manual synchronization
- Provider Lifecycle Status 1.0 Review Draft
- Provider Lifecycle Integration Handoff
- Provider Metadata Contract 1.0
- Legacy Password Sync Contract
- Testing & Seeding
- Security Policy
- Feature Overview
- Deployment Guide
- Core.Domain: Entities, constants, and core business models.
- Core.Application: Interfaces, DTOs, and application logic.
- Infrastructure: Data access (EF Core), external services, and security implementations.
- Web.IdP: The main Identity Provider host (Razor Pages + Vue.js Admin UI).
- samples/: Sample integration clients (M2M, Device Flow, Impersonation).
- Tests/: Comprehensive test suites (System, Integration, Unit).
Powered by OpenIddict:
- Flows: Authorization Code + PKCE, Client Credentials, Device Flow.
- Security: Refresh token rotation with configurable reuse leeway, secure session management.
- Standard Discovery: Full OIDC metadata at
/.well-known/openid-configuration.
- RBAC: Hierarchical roles and fine-grained permissions.
- Impersonation: Secure "Login As" feature for administrative support.
- Observability: Prometheus metrics and structured audit logging.
- Bot Protection: Integrated Cloudflare Turnstile support.
- External Identity: Seamless integration with Google & Microsoft accounts, including auto-linking and AMR support.
- External data sources: Configure approved query inputs separately from profile synchronization output field mappings; independent producers implement the public non-login contracts.
- Branding: Customizable UI with configurable Privacy Policy and Help documentation links.
- First administrator: Disabled-by-default, one-time operational bootstrap for genuinely fresh deployments; see the deployment guidance.
- Backend: .NET 10+, EF Core (SQL Server/PostgreSQL), OpenIddict, SignalR.
- Frontend: Vue.js 3, Vite, Tailwind CSS, Headless UI.
- Testing: xUnit, FluentAssertions, Playwright, Vitest.
- Prerequisites: Docker Desktop, .NET 10 SDK+.
- Run Infrastructure:
docker compose -f docker-compose.dev.yml up -d
- Run App:
dotnet run --project Web.IdP
Fresh installations: use the Setup Wizard:
cd deployment
./setup-env.ps1 # or ./setup-env.shThis generates certificates, passwords, and configuration for a new deployment. Existing deployments must preserve their original .env; do not rerun the wizard to regenerate it. See Deployment Guide for startup instructions.
The new application no longer reads LegacyAuth__*; configure Provider Proof 1.0 independently. Before switching images, verify the producer's exact namespace and that every selected Legacy key is the same opaque stable subject returned by that authority. With a verified restorable backup, use the one-time SQL Server backfill to add the new provider binding to the original UserId. Schema migration does not backfill these links.
Keep the original .env, Legacy links, existing accounts and their MFA/Passkey/recovery data. A matching username, email or GUID-shaped key is not identity proof. Follow the existing-account upgrade procedure for preview, apply, minimal configuration changes and rollback.
Clients displaying user names must request, be allowed, and be granted the OIDC profile scope, then reauthorize. In 1.6.x, name and preferred_username require profile; a custom employee-id scope does not imply it. sub remains the local UserId, and token claim nesting is unchanged. See the client compatibility note.
Distributed under the MIT License. See LICENSE for more information.
This project was developed with significant assistance from advanced AI coding agents. While following industry standards, we recommend a secondary human security audit for production environments. Code is provided "AS IS".