IdentityFlow.Security.DataProtection 0.1.0-alpha.20260620170646

IdentityFlow

IdentityFlow is a modular .NET authentication library for apps that want owned auth flows without tying domain data to an application-specific identity schema.

It provides composable packages for credentials, two-factor recovery, passkeys, external providers, EF Core stores, ASP.NET Core endpoints, cookie/BFF sessions, and OpenIddict hosting.

Install

Use the meta-package for the default stack:

dotnet add package IdentityFlow

Or install only the modules your app needs. A typical ASP.NET Core + EF PostgreSQL host that uses the convenience builder starts with:

dotnet add package IdentityFlow.Core
dotnet add package IdentityFlow.Hosting.AspNetCore
dotnet add package IdentityFlow.Credentials.Password
dotnet add package IdentityFlow.Credentials.EmailOtp
dotnet add package IdentityFlow.Credentials.Passkeys
dotnet add package IdentityFlow.Credentials.TwoFactor
dotnet add package IdentityFlow.Stores.EntityFramework
dotnet add package IdentityFlow.Stores.Postgres
dotnet add package IdentityFlow.Security.DataProtection

IdentityFlow.Hosting.AspNetCore is the convenience hosting package. Use lower-level packages such as IdentityFlow.Hosting.AspNetCore.Authentication, IdentityFlow.Hosting.AspNetCore.Endpoints, and IdentityFlow.Hosting.AspNetCore.Authorization directly when you do not want the whole hosting stack in the same install.

Optional management packages are separate:

dotnet add package IdentityFlow.Management.AspNetCore
dotnet add package IdentityFlow.Management.Client
dotnet add package IdentityFlow.Management.UI.Blazor

Minimal Setup

builder.Services.AddDbContext<IdentityFlowDbContext>(options =>
    options.UseNpgsql(builder.Configuration.GetConnectionString("Auth")));
builder.Services.Configure<IdentityFlowEntityFrameworkStoreOptions>(options =>
    options.DefaultSchema = "auth");

builder.Services
    .AddIdentityFlow()
    .AddEntityFrameworkStores()
    .AddDataProtectionSecrets()
    .AddPasswordCredentials()
    .AddEmailOtpCredentials()
    .AddPasskeyCredentials()
    .AddTwoFactor()
    .AddHybridAuthentication()
    .AddAuthorization();

app.UseAuthentication();
app.UseAuthorization();
app.MapIdentityFlowAuthEndpoints();

IdentityFlow owns its auth schema. Host applications configure the provider, connection string, schema name, endpoint surface, and enabled credential modules.

In-memory stores are development/simple-setup defaults. Multi-node or restart-safe deployments should use EF/distributed cache/Redis packages for durable auth state, rate limiting, DataProtection keys, sessions, delegated OAuth state, and credential-specific stores.

Package Map

• IdentityFlow.Core: shared contracts and auth flow primitives.
• IdentityFlow.Credentials.*: password, email OTP, authenticator app TOTP, passkey, enterprise passkey policy, certificate, API key, personal access token, recovery code, two-factor, and external credential behavior.
• IdentityFlow.ExternalProviders.*: OAuth/OIDC/SAML provider abstractions and common providers.
• IdentityFlow.Stores.*: EF Core store abstractions, concrete EF store, provider packages, and in-memory test stores.
• IdentityFlow.Security.*: data protection, audit, and rate limiting helpers.
• IdentityFlow.Hosting.*: ASP.NET Core endpoint, OpenIddict, and device-code integration.
• IdentityFlow.Management.*: optional management REST API, typed client, and Blazor UI.
• IdentityFlow.Tooling.*: EF migration tooling (Postgres and SQL Server), agent auth test helpers, and Playwright browser auth tooling with its CLI.

Docs

• Quickstart
• Recipes
• EF migrations
• Hosting endpoints
• Security operations
• Provider operations
• Production sample
• Security policy
• Package matrix
• Changelog
• Contributing
• Release versioning

Development

dotnet build IdentityFlow.slnx
dotnet test IdentityFlow.slnx --no-build

License

IdentityFlow is licensed under the MIT License.