IdentityServer Relaunched as Open Source
The popular IdentityServer, a key component for managing authentication and authorization in .NET applications, has been revived as an open-source project. The original project, developed by Brock Allen and Dominick Baier, transitioned to a commercial model, leaving many developers seeking its robust identity management capabilities without a clear open-source path. Richard Vquez Prez has stepped in, taking the original codebase, updating it for .NET 8, fixing critical issues, and releasing it under the permissive Apache 2.0 license. This is not a mere wrapper or a fork with limited functionality; it is a complete, working identity server verified end-to-end.
The resurrected project supports core identity protocols including OAuth 2.0 and OpenID Connect, specifically implementing the authorization code flow with Proof Key for Code Exchange (PKCE). This ensures secure authorization flows, especially for public clients like single-page applications and mobile apps. The server handles Single Sign-On (SSO), allowing users to log in once and access multiple applications within an organization's ecosystem without repeated authentication prompts. This simplifies user experience and reduces the attack surface by centralizing authentication management.
Core Features and Technical Implementation
A significant advancement in this open-source iteration is the generation of JWT access tokens that are scoped per application. This means tokens are issued with specific claims relevant only to the intended resource, such as store.api, inventory.api, or a shared.scope. This granular scoping enhances security by adhering to the principle of least privilege, ensuring that an access token for one API cannot be used to access another. Developers can define and manage these scopes to control precisely what resources each application can access.
Furthermore, the project introduces independent roles and permissions management for each application. Unlike monolithic permission systems, this allows for distinct access control policies to be defined and enforced on a per-application basis. For instance, a user might have administrator privileges in the 'store' application but only read-only access in the 'inventory' application. These application-specific roles and permissions are persisted in a MariaDB or MySQL database, providing a reliable and scalable backend for managing complex authorization models. The project includes two sample applications that demonstrate these capabilities, proving that multi-app SSO and per-app permissions function as intended.
Technical Stack and Compatibility
The project is built on .NET 8, leveraging the latest performance improvements and language features. This ensures that the identity server is modern, efficient, and compatible with the current .NET ecosystem. The use of MariaDB/MySQL for storing roles and permissions offers flexibility, allowing organizations to integrate with their existing database infrastructure or choose a database that best suits their needs. The sample applications are designed to showcase the server's capabilities, providing developers with a practical starting point for integrating the identity server into their own projects.
The decision to release under the Apache 2.0 license is crucial. This license is widely adopted and business-friendly, allowing for free use, modification, and distribution, including in commercial products, with minimal restrictions. This contrasts with more restrictive licenses and ensures broad adoption by developers and companies alike. The project's focus on core identity standards like OAuth 2.0 and OpenID Connect means it can serve as a central authentication authority for a diverse range of applications, from web services and SPAs to mobile clients and desktop applications.
Why This Matters for Developers
The availability of a robust, open-source identity server for .NET 8 addresses a significant gap in the ecosystem. Developers no longer need to rely on commercial solutions or maintain outdated, unsupported versions of IdentityServer. This new project offers a powerful, flexible, and secure way to manage authentication and authorization, complete with modern features like PKCE and granular, per-application permissions. The inclusion of working samples and clear documentation is expected to accelerate adoption and integration, enabling teams to build more secure and user-friendly applications faster.
The project's architecture, which separates concerns and allows for application-specific authorization logic, is a key differentiator. This approach simplifies the management of complex permission models that are common in larger or more specialized applications. By providing a solid foundation for identity management, this open-source initiative empowers developers to focus on their core business logic rather than reinventing authentication and authorization systems from scratch. The future of this project will likely depend on community contributions and ongoing maintenance, but its initial release represents a significant win for the .NET development community.