redb.Identity.Core 4.0.0

Prefix Reserved

dotnet add package redb.Identity.Core --version 4.0.0

NuGet\Install-Package redb.Identity.Core -Version 4.0.0

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="redb.Identity.Core" Version="4.0.0" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="redb.Identity.Core" Version="4.0.0" />
                    

                            Directory.Packages.props

<PackageReference Include="redb.Identity.Core" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add redb.Identity.Core --version 4.0.0

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: redb.Identity.Core, 4.0.0"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package redb.Identity.Core@4.0.0

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=redb.Identity.Core&version=4.0.0
                    

                            Install as a Cake Addin

#tool nuget:?package=redb.Identity.Core&version=4.0.0
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

redb.Identity

A transport-agnostic OAuth 2.1 / OpenID Connect server for the redb ecosystem. Built on OpenIddict and redb.Route. Every endpoint is a direct-vm:// route — call it over HTTP, gRPC, RabbitMQ, SignalR, or straight from another in-process module with zero network overhead. Ships as .tpkg packages for redb.Tsak. REDB-backed, cluster-ready, standards-compliant.

TL;DR

If you want…	redb.Identity gives you…
A full OIDC / OAuth 2.1 server without ASP.NET coupling	A `direct-vm://`-only core: `token`, `authorize`, `userinfo`, `introspect`, `revoke`, `jwks`, `.well-known/openid-configuration`, PAR, JAR (signed request objects), Device Code, Dynamic Registration.
To call Identity from another in-process module with no HTTP	`To("direct-vm://identity-token")` from your own `RouteBuilder`. Zero serialization, zero loopback, zero TLS handshake, same exchange.
HTTP / gRPC / RabbitMQ / SignalR endpoints	Drop in the matching facade `.tpkg`. Each facade is a thin transport bridge — no business logic.
A drop-in user / group / scope / client / consent / audit / session store	Built-in storage via redb.Core typed `*Props` objects. Code-first schemes, no migrations.
Multi-instance / cluster deployment	DataProtection key-ring + signing keys shared through redb object store. Cleanup timers run leader-only via `.Cluster(true)`.
Modern MFA	TOTP (RFC 6238) + SMS/Email OTP + WebAuthn (FIDO2) + Recovery codes.
Self-service for end users	`/me/profile`, `/me/sessions`, `/me/mfa`, `/me/webauthn`, `/me/consents`, `/me/federated`.
Federation	OIDC / GitHub external providers, stored as redb props objects, admin CRUD.
Backchannel logout that works across replicas	RFC 8417-style revoked-SID list (`/revoked-sids/add` + `/since`) + push-and-poll fallback.
SCIM 2.0 provisioning	Users + Groups + Bulk endpoints (RFC 7644).
RFC compliance	OIDC Core, OAuth 2.1, RFC 7662 (Introspection), RFC 7591/7592 (DCR), RFC 8628 (Device Code), RFC 9126 (PAR), RFC 9101 (JAR — JWT-Secured Authorization Request, opt-in), RFC 9068 (JWT access-token profile — `at+jwt`, full claim set, `aud` issued and verified), RFC 9449 (DPoP), RFC 8417 / OIDC Backchannel Logout.
Conformance you can check	Passes the official OpenID Foundation conformance suite — Config OP 0 failures, Basic OP 0 failures (29 pass / 3 review / 1 deliberate warning / 2 skipped). The two skips are the server refusing unsigned `alg:none` request objects — the secure answer FAPI 2.0 mandates, not a missing feature. Details.

Install (NuGet)

Published as of 1.0.1. Add the pieces you need — the provider is chosen by the host:

# Core OIDC / OAuth 2.1 engine (OpenIddict on redb.Route) + a storage provider
dotnet add package redb.Identity.Core
dotnet add package redb.Postgres.Pro      # or redb.MSSql.Pro / redb.SQLite.Pro

# HTTP facade (OIDC + management + SCIM endpoints)
dotnet add package redb.Identity.Http

# Typed client SDK (IIdentityClient) — for BFFs / services calling Identity
dotnet add package redb.Identity.Client

Package	Purpose
`redb.Identity.Core`	OAuth 2.1 / OIDC engine — OpenIddict pipeline, redb stores, MFA, WebAuthn, federation, signing keys
`redb.Identity.Http`	HTTP / HTTPS facade — discovery, token, authorize, userinfo, introspect, JWKS, PAR, DCR, SCIM, `/me`, management
`redb.Identity.Grpc`	gRPC facade — service-to-service surface (token, introspect, revoke, userinfo, discovery, JWKS) + the management services; `.proto` contracts ship in `redb.Identity.Contracts` under `Protos/`
`redb.Identity.Soap`	WS-Trust facade — `Issue`, `Validate`, `Cancel`, `Renew` over SOAP on the same core routes; WSDL published on GET; TLS required, and its absence is a refusal to start