My next Step
Exactly four years after we started Duende, it’s time for the next chapter… https://blog.duendesoftware.com/posts/20240903_duende_next_chapter/
View ArticleWhat’s going on?
I just realized that my last blog post was over half a year ago when we announced our new company Duende Software. So what happened in the last 6 months of my life? In short – a ton! We left our...
View ArticleThe Future of IdentityServer
Tl:dr https://blog.duendesoftware.com/posts/20201001_helloduende/ Brock Allen and I have been working on the IdentityServer code-base for more than 10 years. In 2020 we will be making some important...
View ArticleFlexible Access Token Validation in ASP.NET Core
The ASP.NET Core authentication system went through a couple of iterations, and is pretty good now. For API scenarios, the typical choice is the JwtBearer authentication handler, which can validate...
View ArticleRefresh Tokens in IdentityServer4 v4
I already wrote about the hardening of refresh tokens in this post. I would recommend reading this first. The upcoming OAuth 2.1 spec is pretty clear about refresh token handling: If the client is...
View ArticleAnnouncing IdentityServer4 v4.0
OK – it’s finally done. I published v4 to Nuget earlier today. You can find the complete set of changes/bug fixes/breaking changes here. We had to cut some features which were originally on our...
View ArticleResource Access in IdentityServer4 v4 and going forward
In my last post I alluded to the tension between real-world token-based security architectures, the OAuth 2.0 scope model, JWT access tokens and the audience claim. We went through a couple of...
View ArticleI don’t like Identity Tokens
…or rather the name ;) I bet that if you wake up most “identity professionals” in the middle of the night and ask them what an identity token is, the answer would be “a token about the identity of the...
View ArticleClik here to view.
The JWT Profile for OAuth 2.0 Access Tokens (and IdentityServer)
As part of creating our new Advanced OAuth training, I created a whole lecture on the evolution of access tokens and resource access. It’s fascinating – since the original OAuth 2.0 spec does not have...
View ArticleUpdates on our Workshops
I am pleased to announce that we are now offering two workshops. I was mentioning that on Twitter already, and got a lot of questions. So I thought it would make sense to summarise them all in one...
View ArticleAutomatic Token Management for ASP.NET Core and Worker Services 1.0
After a pretty long preview period, I am happy to announce that IdentityModel.AspNetCore 1.0 is now on Nuget. This library solves a problem that we have with every single OIDC/OAuth client we are...
View ArticleMajor Update to IdentityModel.OidcClient
I just pushed Preview 3 of the 4.0 version of IdentityModel.OidcClient – this includes some major updates (that you might or might not have asked for): Removal of OpenID Connect Hybrid Flow. The...
View ArticleSPAs are dead!?
clickbait isn’t it? But this was Brock’s immediate reaction when we saw (and I recommend you read this first): Full Third-Party Cookie Blocking and More What this basically means is, that browser are...
View ArticleOnline Workshops in 2020
For obvious reasons, all in-person workshops have been cancelled for the time being. This is frustrating on one hand, but converting them to an online format, will allow people to attend who otherwise...
View ArticleMutual TLS and Proof-of-Possession Tokens: Summary
This is the last part of my PoP and Mutual TLS post series. Part 1 covered some history and motivation, and part 2 looked at various server setups. Part 3 was supposed to be a walk-through guide on how...
View ArticleMutual TLS and Proof-of-Possession Access Tokens – Part 1: Setup
2020 is the year where I want proof-of-possession tokens to become reality. Mutual TLS seems to be the only feasible way to do that today. So here’s another post about it…. This is a two-part post. In...
View ArticleHardening OpenID Connect/OAuth Authorize Requests (and Responses)
One of the biggest strengths of OIDC and OAuth is the usage of the browser front-channel. The browser can show a UI and follow redirects, this makes it very powerful and flexible. Guess what – the...
View ArticleHardening Refresh Tokens
Refresh tokens provide a UX friendly way to give a client long-lived access to resources without having to involve the user after the initial authentication & token request. This makes them also a...
View Article2020: IdentityServer4 Roadmap
It’s the time of the year – we are working on IdentityServer and lock down the features we want to implement for the next version(s). Initially we planned to make our 3.0 release the big one – but then...
View ArticleNew in IdentityServer4 v4: Multiple signing Keys
So far IdentityServer4 only supported a single signing key at a time. There are historic reasons for that. When we started with .NET Core, the only x-plat algorithm that really worked (without #ifdef...
View Article
