⭐ Star us on GitHub: your support motivates us a lot! 🙏😊

Add a certified OpenID Connect provider to your own ASP.NET Core app, one you embed and own end to end rather than a separate server to run and operate.

📑 For the full picture, see the technical overview.

• About
• Quickstart
• What's New
• Certification
• How to Install
• Documentation
• Abblix Account
• Feedback and Contributions
• License
• Contacts

Abblix OIDC Server turns your ASP.NET Core application into a fully certified OpenID Connect provider. Rather than deploying and operating a separate identity server, you embed the protocol directly into your app, so your users, your data, and your UI stay inside your product.

• Certified: all seven OpenID Provider profiles and all four logout profiles, 634 conformance tests passed with none skipped and no warnings. FAPI is not among them.
• A library you own, not a server you run: the OpenID Connect endpoints live inside your app, so users, data, and UI never leave it.
• Current with the modern security stack: DPoP, PAR, JARM, RAR, token exchange, and certificate-bound tokens, alongside the OAuth 2.0 and OpenID Connect core.
• Engineering you can audit: 2000+ passing tests, top SonarCloud security, reliability, and maintainability ratings, and CodeQL scanning on every change.
• Modern .NET, minimal friction: targets .NET 11, with drop-in adapters for both MVC and Minimal API.

Under the hood, the library leans on modular and hexagonal architecture and the standard .NET DI container, which keeps it testable and easy to extend. It ships two ASP.NET Core integration adapters that expose the same OpenID Connect endpoints (one for MVC controllers and routing, one for Minimal API endpoint routing), so you adopt whichever hosting model your application already uses, without taking a dependency on the other.

Install the adapter for your hosting model and register the server in Program.cs:

dotnet add package Abblix.OIDC.Server.MVC

using Abblix.Jwt;
using Abblix.Oidc.Server.Mvc;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllersWithViews();

// Turn your ASP.NET Core app into an OpenID Connect provider
builder.Services.AddOidcServices(options =>
{
    options.LoginUri = new Uri("/Auth/Login", UriKind.Relative);
    options.SigningKeys = new[] { JsonWebKeyFactory.CreateRsa(PublicKeyUsages.Signature) };
});

That registers the full set of certified OpenID Connect endpoints. Point LoginUri at your login page and plug in your user store. The Getting Started Guide walks through a complete, runnable solution.

🚀 Features

• Minimal API integration: every OIDC endpoint as ASP.NET Core route handlers via the new Abblix.OIDC.Server.MinimalAPI package, with full protocol parity with the MVC integration
• External signing keys: private keys held in HashiCorp Vault / OpenBao Transit (Abblix.JWT.Vault) or Azure Key Vault (Abblix.JWT.Azure) - the private halves never enter the process, the public halves publish to the JWKS endpoint
• Security events and Shared Signals: a new package family implementing Security Event Tokens (RFC 8417) with Subject Identifiers (RFC 9493), push and poll SET delivery (RFC 8935, RFC 8936), the OpenID Shared Signals Framework 1.0 in both transmitter and receiver roles, and the CAEP 1.0 and RISC 1.0 event dictionaries

See 📋Release Notes for full details.

We are certified in all profiles. During the certification process, we skipped ZERO tests and received NO warnings. All 634 tests . For more details, click the links (Certified OpenID Providers & Profiles, Certified OpenID Providers for Logout Profiles).

For convenience, the certification information is provided in the tables below:

Add the adapter that matches your ASP.NET Core hosting model from NuGet.

For MVC controllers and routing:

dotnet add package Abblix.OIDC.Server.MVC

For Minimal API endpoint routing:

dotnet add package Abblix.OIDC.Server.MinimalApi

Both adapters expose the same OpenID Connect endpoints and pull in the core Abblix.OIDC.Server package as a dependency, so pick the one that matches how your application maps requests. For hosts that wire the protocol layer directly, install Abblix.OIDC.Server instead.

Explore the Getting Started Guide. In this guide, you will create a working solution step by step, building an OpenID Connect Provider using ASP.NET MVC and the Abblix OIDC Server solution.

Migrating from IdentityServer4 or Duende walks through a real migration end to end: dotnet/eShop's Identity.API moved from Duende IdentityServer onto Abblix OIDC Server, every decision named along the way.

A working Shared Signals transmitter and receiver for ASP.NET Core shows two hosts exchanging a signed Security Event Token over HTTPS, each verifying the other.

The Documentation site covers configuration, deployment, the API reference and the OpenID Connect standard itself.

Prefer not to run the provider yourself? Abblix Account is a ready-to-use service hosted in the cloud, built on this library. You get passkeys, MFA, social login, and security event notifications: everything your users need, integrated into your website in minutes.

👉 See it live: Quorvel Coffee is a demo application using Abblix Account for user authentication. It shows how sign-in flows, session management, and user self-service, all delivered by Abblix Account, fit into a client website.

The protocol surface is complete and certified, but the library is not finished. What you run into in your own application is what we cannot see from here.

Please feel free to contribute by submitting an issue or joining the discussions.

For how we handle contributions, and why the library is developed in-house, see our Contributing Guidelines.

This product is distributed under a source-available proprietary license. See 📋License Agreement for details.

It is free of charge for companies under $1M in annual revenue and under $1M raised in outside funding, for non-profits, educational institutions, personal projects and non-commercial open source, and for development, test and staging environments at any size. Every protocol is included at every tier, with no limit on client applications or users, and one production issuer per free deployment. See the pricing page.

For more details about our products, services, or any general information regarding the Abblix OIDC Server, feel free to reach out to us. Below are the best ways to contact our team:

• General inquiries: info@abblix.com
• Support and security reports: support@abblix.com, see the Security Policy
• Website: Visit the official Abblix OIDC Server page for more information: Abblix OIDC Server.

Subscribe to our LinkedIn and Twitter:

Back to top