The open, self-hostable identity server for .NET teams, a fully-featured alternative to Duende IdentityServer and Auth0 that you run. API-only ASP.NET Core server + React login SPA, shipped as a single Docker image, or embedded as a library in your own ASP.NET project. Built on a custom OIDC/OAuth2 protocol implementation, no OpenIddict or Duende dependency.
☁️ Don't want to run it yourself?
Authagonal Cloud is the fully-managed version, multi-tenant SSO, SCIM, MFA, custom domains, and a management portal, with every feature on every plan and no per-connection SSO fees. Self-host the OSS here, or let us operate it → authagonal.io
Quick Start
docker compose up
This starts the auth server on http://localhost:8080 with an Azurite storage emulator.
Projects
| Project | Description |
|---|
src/Authagonal.Core | Domain models, interfaces, extensibility contracts |
src/Authagonal.Protocol | Embeddable OIDC / OAuth 2.0 protocol surface, bring your own identity (IOidcSubjectResolver) and storage (IClientStore / IGrantStore / IScopeStore / ISigningKeyStore). No user store, no SAML, no admin UI. |
src/Authagonal.AzureProvider | Azure Table Storage implementation of the stores (formerly Authagonal.Storage) |
src/Authagonal.AwsProvider | AWS implementation, DynamoDB / S3 / Secrets Manager stores and clustering |
src/Authagonal.SqlProvider | Self-hosted SQL implementation, PostgreSQL or SQLite, plus clustering and the DataProtection key ring |
src/Authagonal.Backup | Backup, restore, merge and rollup library for the storage backends |
src/Authagonal.Server | ASP.NET Core host, OIDC, SAML, auth API, admin API |
login-app | React/TypeScript login SPA (Vite), published as @authagonal/login |
tools/Authagonal.Migration | Duende IdentityServer → Table Storage migration tool |
tools/Authagonal.Backup | Azure Table Storage backup tool (incremental support) |
tools/Authagonal.Restore | Azure Table Storage restore tool (upsert, merge, clean modes) |
tests/Authagonal.Tests | Unit tests |
tests/load | k6 load tests (smoke, stress, soak) |
demos/custom-server | Demo: host Authagonal as a library with custom extensions |
demos/sample-app | Demo: client app (API + React SPA) authenticating via Authagonal |
Features
- OIDC Provider: authorization_code + PKCE, client_credentials, refresh_token, device_code grants
- SAML 2.0 SP: homebrew implementation, full Azure AD support
- Dynamic OIDC Federation: Google, Apple, Azure AD, configure via API or
appsettings.json
- SAML/OIDC from Config: define identity providers in configuration, seeded on startup
- OAuth Consent Screen: per-client
RequireConsent flag, scope-aware re-consent, grant management UI
- Device Authorization Grant: RFC 8628 flow for input-constrained devices (smart TVs, CLIs, IoT)
- Token Introspection: RFC 7662
POST /connect/introspect for resource servers to verify token validity
- Token Revocation: RFC 7009
POST /connect/revocation; revocations tracked in a persistent revocation list consulted by the introspection endpoint
- Dynamic Client Registration: RFC 7591
POST /connect/register for clients to self-register at runtime (opt-in via Auth:DynamicClientRegistrationEnabled), advertised via the discovery document when enabled
- Scope Management: admin CRUD for OAuth scopes (
/api/v1/scopes); custom scopes advertised dynamically by discovery and surfaced on the consent screen
- Back-Channel Logout: OIDC Back-Channel Logout 1.0; logout tokens sent to each client's
BackChannelLogoutUri
- Front-Channel Logout: OIDC Front-Channel Logout 1.0 (RFC 7711); logout notification via the browser with configurable session requirements per client
- Multi-Factor Authentication: TOTP (authenticator apps), WebAuthn/passkeys, recovery codes. Per-client MFA policy (
Disabled, Enabled, Required) with IAuthHook override for per-user control.
- Configurable Password Policy: min length, character requirements, exposed via API for dynamic frontend validation
- TCC Provisioning: Try-Confirm-Cancel provisioning into downstream apps on all user creation endpoints (admin, registration, SSO, SCIM). Pluggable via
IProvisioningAppProvider.
- Auth Hooks:
IAuthHook extensibility point for audit logging, custom validation, webhooks. Multiple implementations run in registration order.
- Role-Based Access Control: role CRUD, user-role assignment/removal via admin API ()
Deployment Options
| Option | Description |
|---|
| Docker image | drawboardci/authagonal, pre-built, configure via env vars and branding.json |
| NuGet library | Reference Authagonal.Server + a provider (Authagonal.AzureProvider, Authagonal.SqlProvider or Authagonal.AwsProvider), call AddAuthagonal(), override services |
| npm package | @authagonal/login, the login SPA as a component library; import base components, override what you need |
| Managed cloud | Authagonal Cloud, we host and operate it for you |
Docker
# Build server image
docker build -t authagonal .
# Build migration tool
docker build -f Dockerfile.migration -t authagonal-migration .
Development
# Storage emulator (the default appsettings.json expects Azurite on its default ports)
docker run -d -p 10000-10002:10000-10002 mcr.microsoft.com/azure-storage/azurite
# Server (requires .NET 10 SDK)
dotnet run --project src/Authagonal.Server
# Login app
cd login-app && npm install && npm run dev
Hosting as a Library
var builder = WebApplication.CreateBuilder(args);
// Override extensibility points before AddAuthagonal (multiple hooks supported)
builder.Services.AddSingleton<IAuthHook, MyAuditHook>();
builder.Services.AddSingleton<IEmailService, MyEmailService>();
builder.Services.AddAuthagonal(builder.Configuration);
var app = builder.Build();
app.UseAuthagonal();
app.MapAuthagonalEndpoints();
app.MapFallbackToFile("index.html");
app.Run();
See demos/custom-server/ for a complete example.
Two things every new deployment needs:
- Email: set
Email:ResendApiKey + Email:SenderEmail to activate the built-in Resend sender, or register your own IEmailService before AddAuthagonal. Without one, verification and reset emails are discarded, and since login requires a confirmed email by default, self-registered users can't sign in (set Auth:AutoConfirmEmailDomains to skip verification for your domains).
- Admin API access: seed a
client_credentials client holding the authagonal-admin scope in the Clients: config section. Config-seeded clients are the only way to hold that scope; the API and dynamic registration refuse to grant it (so a runtime client can never escalate).
Load Testing
# Quick smoke test
k6 run tests/load/smoke.js -e BASE_URL=http://localhost:8080
# Stress test (ramps to 100 VUs)
k6 run tests/load/stress.js
# Soak test (30 minutes sustained load)
k6 run tests/load/soak.js -e DURATION=30m
Configuration
See the full documentation for configuration reference.
License
MIT
