redb.Identity

auth & SSO

Transport-agnostic OAuth 2.1 / OpenID Connect server

An OAuth 2.1 / OpenID Connect server for the redb ecosystem, built on OpenIddict and redb.Route. Every endpoint is a direct-vm:// route — call it over HTTP, gRPC, RabbitMQ, SignalR, or straight from another in-process module with zero network overhead. redb-backed, cluster-ready, standards-compliant. Ships as .tpkg packages for redb.Tsak.

OIDCOAuth 2.1PKCEDPoPPARDCRSCIM 2.0FIDO2Token Exchange
GitHub ↗ NuGet ↗
40
RFCs in code
1767
tests (PG·MSSQL·SQLite)
44
HTTP endpoints
79
audit events

What's inside

  • Transport-agnostic: every endpoint is a direct-vm:// route — call it over HTTP / gRPC / RabbitMQ / SignalR, or in-process from another module with zero network overhead.
  • Full OAuth 2.1 / OIDC: Authorization Code + PKCE, Client Credentials, Refresh, Device Code, Token Exchange, PAR, DPoP, Dynamic Client Registration (DCR).
  • SCIM 2.0 provisioning (Users / Groups / Bulk), federation (OIDC / GitHub / LDAP), backchannel logout across replicas.
  • MFA: TOTP (RFC 6238), SMS / Email OTP, WebAuthn / FIDO2, recovery codes.
  • Built on redb typed storage: 24 code-first schemes, no migrations; Postgres / MSSQL / SQLite from one codebase.
  • First-class audit: 79 typed events across 7 categories, with external sinks (Kafka / Elasticsearch / RabbitMQ / log). Cluster-ready; ships as .tpkg for redb.Tsak.

40 RFCs implemented in code

RFC 2898RFC 4226RFC 4514RFC 4515RFC 6238RFC 6265RFC 6585RFC 6749RFC 6750RFC 7009RFC 7230RFC 7231RFC 7232RFC 7234RFC 7235RFC 7515RFC 7517RFC 7519RFC 7521RFC 7523RFC 7591RFC 7592RFC 7636RFC 7638RFC 7643RFC 7644RFC 7662RFC 7693RFC 7800RFC 7807RFC 8176RFC 8252RFC 8259RFC 8414RFC 8417RFC 8628RFC 8693RFC 9126RFC 9449RFC 9457

Latest releases

  • 4.0.0
    • [RedbUnique] on the real properties — ApplicationProps.ClientId, ScopeProps.ScopeName,
    • ValueUnique for the root-only schemes — IdentitySystemFlagProps (props empty by
    • One typed catch — the scheme-key paths catch RedbUniqueViolationException instead of
    • Transition backfill (V4UniqueBackfillListener, idempotent by construction, no flag)
  • 3.7.2
  • 3.7.1
    • redb.Identity.DataProtection — System.Security.Cryptography.Xml 9.0.4, SEVEN advisories at
    • redb.Identity.Http — Microsoft.Bcl.Memory 9.0.0 ([GHSA-73j8-2gch-69rq], high), transitively
All releases (13) →

Articles on redb.Identity

redb for business: your team writes business logic, the infrastructure is already built With redb your team writes only business logic: what the ecosystem replaces, what it costs, which risks it removes, and what to know before you start.
redb 4.0: XML routes, lazy references, unique keys and WS-Trust in one major release One major release across the ecosystem: what's new in redb.Core, Route, Tsak and Identity, what got fixed on security, and what breaks.
Your access token was stolen. Now what: three layers of defence in your own OpenID provider A bearer token works for whoever holds it. Three layers in redb.Identity: BFF, key-bound tokens via DPoP, fast revocation. Plus what a stolen database yields.
WS-Trust over OAuth: a third transport for the OpenID server, for the estate that runs on SOAP redb.Identity gained a WS-Trust facade: Issue, Validate, Cancel, Renew on the same core routes. The same JWT, the same client registry, WSDL for the generator.
Microservices in .NET without building a platform: a cluster of workers, one dashboard, hot-swapped modules The same artifact deploys as a monolith and as a cluster of microservices. Same modules, one dashboard over every worker, hot swap with no container restart.
redb 3.7: our own gRPC wire, cutting props before the aggregate, and a release withdrawn a day later Our own gRPC wire in Route, props cut before the aggregate in redb.Core, Tsak closed by default, a second Identity facade. And 3.7.0, withdrawn a day later.
Our OpenID server got a second transport: gRPC beside HTTP, on the same routes redb.Identity now has a gRPC facade: same core routes, same client registry, one token honoured by both transports. What is inside, how to switch it on.
Running our OpenID server through the official conformance suite, and what it found in us Running the OIDF conformance suite on redb.Identity: setup, running it by hand, and the real bugs it found, including a phone number in the id_token.
All articles on redb.Identity (12) →

Docs and examples for this product are coming soon. For now, see GitHub and the README.

← Back to all products