{"id":36855,"date":"2016-09-19T09:37:53","date_gmt":"2016-09-19T16:37:53","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/webdev\/?p=7645"},"modified":"2016-09-19T09:37:53","modified_gmt":"2016-09-19T16:37:53","slug":"introducing-identityserver4-for-authentication-and-access-control-in-asp-net-core","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/introducing-identityserver4-for-authentication-and-access-control-in-asp-net-core\/","title":{"rendered":"Introducing IdentityServer4 for authentication and access control in ASP.NET Core"},"content":{"rendered":"

This is a guest post by Brock Allen and Dominick Baier. They are security consultants, speakers, and the authors of many popular open source security projects, including IdentityServer.<\/em><\/span><\/p>\n

Modern applications need modern identity. The protocols used for implementing features like authentication, single sign-on, API access control and federation are OpenID Connect and OAuth 2.0. IdentityServer<\/a> is a popular open source framework for implementing authentication, single sign-on and API access control using ASP.NET.<\/p>\n

While IdentityServer3 has been around for quite a while, it was based on ASP.NET 4.x and Katana. For the last several months we\u2019ve been working on porting IdentityServer to .NET Core and ASP.NET Core. We are happy to announce that this works is now almost done and IdentityServer4 RC1 was published to NuGet on September 6th.<\/p>\n

IdentityServer4 allows building the following features into your applications:<\/p>\n

Authentication as a Service<\/strong>\nCentralized login logic and workflow for all of your applications (web, native, mobile, services and SPAs).<\/p>\n

Single Sign-on \/ Sign-out<\/strong>\nSingle sign-on (and out) over multiple application types.<\/p>\n

Access Control for APIs<\/strong>\nIssue access tokens for APIs for various types of clients, e.g. server to server, web applications, SPAs and native\/mobile apps.<\/p>\n

Federation Gateway<\/strong>\nSupport for external identity providers like Azure Active Directory, Google, Facebook etc. This shields your applications from the details of how to connect to these external providers.<\/p>\n

Focus on Customization<\/strong>\nThe most important part – many aspects of IdentityServer can be customized to fit your needs. Since IdentityServer is a framework and not a boxed product or a SaaS, you can write code to adapt the system the way it makes sense for your scenarios.<\/p>\n

You can learn more about IdentityServer4 by heading to https:\/\/identityserver.io<\/a>. Also you can visit the github repo<\/a>, the documentation<\/a>, and see our support options<\/a>.<\/p>\n

There are also quick-start tutorials and samples that walk you through common scenarios for protecting APIs and implementing token-based authentication.<\/p>\n