Abblix.OIDC.Server 2.4.0

Prefix Reserved
.NET 8.0 This package targets .NET 8.0. The package is compatible with this framework or higher. 
dotnet add package Abblix.OIDC.Server --version 2.4.0
                    


                    

                
NuGet\Install-Package Abblix.OIDC.Server -Version 2.4.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Abblix.OIDC.Server" Version="2.4.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Abblix.OIDC.Server" Version="2.4.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Abblix.OIDC.Server" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Abblix.OIDC.Server --version 2.4.0
                    


                    

                
#r "nuget: Abblix.OIDC.Server, 2.4.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Abblix.OIDC.Server@2.4.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Abblix.OIDC.Server&version=2.4.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Abblix.OIDC.Server&version=2.4.0
                    


                            Install as a Cake Tool

Abblix OIDC Server

Abblix OIDC Server is a .NET library implementing the server side of OpenID Connect and OAuth 2.0: a certified provider you embed in your own ASP.NET Core application instead of running a separate identity product. It is certified by the OpenID Foundation across all login and logout profiles, builds on the standard .NET DI container, and uses its own JWT implementation built on .NET cryptographic primitives.

What's New in Version 2.4

🚀 Features

  • Minimal API integration: every OIDC endpoint as ASP.NET Core route handlers via the new Abblix.OIDC.Server.MinimalAPI package, with full protocol parity with the MVC integration
  • External signing keys: private keys held in HashiCorp Vault / OpenBao Transit (Abblix.JWT.Vault) or Azure Key Vault (Abblix.JWT.Azure) - the private halves never enter the process, the public halves publish to the JWKS endpoint
  • Security events and Shared Signals: a new package family implementing Security Event Tokens (RFC 8417) with Subject Identifiers (RFC 9493), push and poll SET delivery (RFC 8935, RFC 8936), the OpenID Shared Signals Framework 1.0 in both transmitter and receiver roles, and the CAEP 1.0 and RISC 1.0 event dictionaries
  • A per-client security profile enforcing the FAPI 2.0 Security Profile control set as one setting: a server-wide profile is a floor no client can step under, and a client may hold itself to more
  • Revocation of every token issued to a user or within one session, and cross-client token introspection for protected resources (RFC 7662)
  • Opt-in endpoint registration, Authorization Server Metadata at its OAuth 2.0 well-known address (RFC 8414), strict request-object processing (RFC 9101), and per-client requirements for pushed authorization requests, signed request objects and certificate-bound tokens
  • Independent signing and encryption settings per token type, an allow list for outbound fetches, and refresh tokens that rotate by default (RFC 9700)

Implemented Standards

Abblix OIDC Server implements the following standards for authorization and security:

OAuth 2.0

JSON Web Token (JWT)

OpenID Connect

Install

dotnet add package Abblix.OIDC.Server

Note: Most applications should use Abblix.OIDC.Server.MVC or Abblix.OIDC.Server.MinimalAPI, which include this package plus the ASP.NET Core endpoint wiring.

Package Description
Abblix.Utils Utility library with crypto, URI, and JSON helpers
Abblix.DependencyInjection .NET DI extensions with aliasing, composites, and decorators
Abblix.JWT JWT signing, encryption, and validation using .NET crypto primitives
Abblix.JWT.Vault Signing and decryption keys held in HashiCorp Vault / OpenBao Transit
Abblix.JWT.Azure Signing and decryption keys held in Azure Key Vault
Abblix.OIDC.Server Core OpenID Connect server implementation (this package)
Abblix.OIDC.Server.MVC ASP.NET Core MVC integration
Abblix.OIDC.Server.MinimalAPI ASP.NET Core Minimal API integration
Abblix.SecurityEvents Security Event Tokens (RFC 8417) and Subject Identifiers (RFC 9493): building, validation, and the delivery data types
Abblix.SecurityEvents.CAEP The CAEP 1.0 event dictionary: session and access lifecycle
Abblix.SecurityEvents.RISC The RISC 1.0 event dictionary: account risk incidents
Abblix.SharedSignals OpenID Shared Signals Framework 1.0 transmitter and receiver
Abblix.SharedSignals.MinimalAPI SSF endpoints as ASP.NET Core Minimal API route handlers
Abblix.SharedSignals.Redis Redis-native event outbox for multi-replica transmitters

Getting Started

To learn more about the Abblix OIDC Server product, visit our Documentation site and explore the Getting Started Guide.

License

Abblix.OIDC.Server is licensed under the Abblix license agreement. See LICENSE.md.

Contacts

Product Compatible and additional computed target framework versions.
.NET net8.0 is compatible.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed.  net9.0 is compatible.  net9.0-android was computed.  net9.0-browser was computed.  net9.0-ios was computed.  net9.0-maccatalyst was computed.  net9.0-macos was computed.  net9.0-tvos was computed.  net9.0-windows was computed.  net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (2)

Showing the top 2 NuGet packages that depend on Abblix.OIDC.Server:

Package Downloads
Abblix.OIDC.Server.MVC

ASP.NET Core MVC integration for Abblix OIDC Server, the certified OpenID Connect and OAuth 2.0 provider. Controllers, model binding and routing for every protocol endpoint: add it to a controller-based application and get a complete identity provider.
Abblix.OIDC.Server.MinimalAPI

ASP.NET Core Minimal API integration for Abblix OIDC Server, the certified OpenID Connect and OAuth 2.0 provider. Every protocol endpoint as a route handler with no MVC dependency: the lightest way to host an identity provider in .NET.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
2.4.0 122 9/5/2026
2.3.0 240 6/9/2026
2.2.0 422 2/18/2026
2.1.0 520 12/8/2025
2.0.1 686 12/1/2025
2.0.0 277 11/26/2025
1.6.0 348 8/14/2025
1.5.0 298 6/25/2025
1.4.0 346 4/9/2025
1.3.1 308 12/3/2024
1.3.0.1 262 11/28/2024
1.3.0 259 11/13/2024
1.2.0.1 256 10/16/2024
1.2.0 260 10/11/2024
1.1.0 387 7/9/2024
1.0.100 279 5/3/2024
Loading failed

Run a certified OpenID Provider inside your own ASP.NET Core application instead of operating a separate identity product. Abblix OIDC Server is a library: it builds on the standard .NET dependency injection container, stores nothing you do not choose to store, and passes the OpenID Foundation conformance suite in every login and logout profile. What you get: authorization code with PKCE, hybrid and implicit flows, client credentials, device authorization, CIBA, token exchange (RFC 8693) and Rich Authorization Requests (RFC 9396); pushed authorization requests, signed and encrypted request objects, JARM responses and sender-constrained tokens through DPoP or mutual TLS; dynamic client registration and management, discovery and Authorization Server Metadata (RFC 8414), token introspection and revocation, front-channel and back-channel logout, session management. New in 2.4: a per-client security profile that enforces the FAPI 2.0 control set as one setting, revocation of every token issued to a user or within a session, cross-client introspection for protected resources, opt-in endpoints, strict request-object processing (RFC 9101), per-client requirements for PAR, signed request objects and certificate-bound tokens, independent signing and encryption settings per token type, an allow list for outbound fetches, and refresh tokens that rotate by default (RFC 9700). Host it through the MVC or the Minimal API integration package. Full details: https://github.com/Abblix/Oidc.Server/releases/tag/v2.4