IdentityServer4
7 articles
IdentityServer4 — Customise Part 1 — Replacing InMemory Clients
Replacing the default InMemoryClientStore with a custom IClientStore backed by MongoDB — swapping AddInMemoryClients for AddClientStore<T> in the IS4 startup configuration.
IdentityServer4 — Part 6 — Protecting API — Client Credentials Example
End-to-end Client Credentials flow with IdentityServer4 — setting up the Identity Server, protecting an ASP.NET Core API with JwtBearer, and calling it from a console app using IdentityModel.
IdentityServer4 — Part 5 — Scopes and Resources
Defining custom identity scopes with claims, built-in StandardScopes and JwtClaimTypes, and custom API resources in IdentityServer4 — with a full authorization code flow example.
IdentityServer4 — Part 4 — Refresh Tokens
What refresh tokens are, when they are issued, how to exchange them using raw HttpClient, and how the IdentityModel package simplifies the authorization code and refresh token flows.
IdentityServer4 — Part 3 — Flows
Step-by-step breakdown of all 7 OpenID Connect flows grouped by response_type — Authorization Code, Implicit, and Hybrid variants with a summary table of channels and token types.
IdentityServer4 — Part 2 — GrantTypes, ResponseTypes
The difference between response_type and grant_type — how each maps to OAuth2 flows, the token and authorization endpoints they target, and GrantTypes in IdentityServer4.
IdentityServer4 — Part 1
Introduction to OAuth 2.0 and OpenID Connect — client types, front vs back channel, all four OAuth2 flows, three OpenID Connect flows, and the role of response_type vs grant_type.