Nedo.AspNet.Authentication.Local 2.0.0

Nedo.AspNet.Authentication

A modular authentication platform for ASP.NET Core. Six SPA-friendly social providers (Google, Microsoft, Apple, GitHub, Facebook, Keycloak) that mint your own JWTs · four enterprise OIDC providers (Keycloak, Entra ID, Auth0, Okta) for the JWT-bearer pattern · Local username/password with refresh-token families, email verification, password reset, account management · TOTP 2FA that auto-gates every sign-in path · dev-only impersonation endpoint · multi-tenant resolution. All composable NuGet packages.

Authentication only — verifies who the caller is. Authorization (what the caller can do) is handled separately.

Architecture

Nedo.AspNet.Authentication
├── Core
│   ├── Abstractions          Zero-dependency contracts (IAuthContext, IAuthEventSink, AuthMode)
│   ├── Authentication        JWT Bearer, middleware, DI engine
│   ├── TokenManagement       Token forwarding + client-credentials refresh
│   └── Claims                Claims transformation pipeline
│
├── Local
│   └── Local                 Username/password, refresh-token families with reuse detection,
│                             email verify, password reset, external-login linking,
│                             account management endpoints, AuthOutcome discriminated outcome,
│                             5 focused services (Login / Registration / ExternalSignIn /
│                             PasswordReset / EmailVerification) sharing SessionTokenIssuer
│
├── Shared OIDC plumbing
│   └── Oidc                  OidcIdTokenValidatorBase + OAuthCodePopupEndpoints helper,
│                             reused by every social provider
│
├── Social Identity Providers (each issues Nedo JWTs after upstream verification)
│   ├── Google                OIDC ID-token exchange (Google Identity Services)
│   ├── Microsoft             OIDC ID-token exchange (MSAL.js, consumers/work/multi-tenant)
│   ├── Apple                 OIDC ID-token exchange (Apple JS SDK)
│   ├── GitHub                OAuth code exchange (popup + postMessage)
│   ├── Facebook              Graph API access-token verification (FB JS SDK)
│   └── Keycloak (SignIn)     OAuth code exchange via AddKeycloakSignIn
│
├── Enterprise Identity Providers (your API as resource server, validates upstream JWTs)
│   ├── Keycloak (Bearer)     realm_access roles, resource_access (AddKeycloak)
│   ├── EntraId               Azure AD app roles, group mapping
│   ├── Auth0                 Namespace-prefixed claims, RBAC
│   └── Okta                  Authorization server, groups → roles
│
├── Security extensions
│   ├── Totp                  TOTP 2FA (RFC 6238) — auto-gates every sign-in path via IMultiFactorChallenge
│   └── Dev                   Dev-only POST /auth/dev/sign-in (refuses outside Development env)
│
└── Cross-Cutting
    ├── MultiTenant           Tenant resolution (header, claim, subdomain)
    └── Diagnostics           Circuit breaker, IdP health check

Quick Start

dotnet add package Nedo.AspNet.Authentication

using Nedo.AspNet.Authentication;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddNedoAuthentication(options =>
{
    options.Authority = "https://keycloak.example.com/realms/my-realm";
    options.Audience = "my-api";
});

var app = builder.Build();

app.UseAuthentication();
app.UseNedoAuthContext();
app.UseAuthorization();

app.MapGet("/me", (IAuthContext auth) => Results.Ok(new
{
    auth.UserId,
    auth.Email,
    auth.Roles,
    auth.TenantId
}));

app.Run();

Documentation

Start at docs/README.md for a task-oriented index.

For a runnable end-to-end example of Local + all six social providers + 2FA + dev-auth driving a React SPA, see sample/Nedo.AspNet.Authentication.Local.Sample (.NET API) and sample/Nedo.AspNet.Authentication.Local.Sample.React (Vite + React + TypeScript).

Build & Test

dotnet build
dotnet test                   # 91 tests
dotnet run --project sample/Nedo.AspNet.Authentication.Sample

Releasing

All 20 packages are published together on every v* git tag via .gitlab-ci.yml. See PUBLISHING.md for the operator runbook (version flow, required CI/CD variables, dry-run instructions, common failure modes).

git tag v1.2.0
git push origin v1.2.0   # → GitLab builds + pushes all 20 to nuget.org

License

MIT