Authagonal

OAuth 2.0 / OpenID Connect / SAML 2.0 authentication server for .NET, backed by pluggable storage: your own PostgreSQL or SQLite, Azure Table Storage, or AWS (DynamoDB / S3 / Secrets Manager).

A single, self-contained deployment. The server and login UI ship as one Docker image, the SPA is served from the same origin as the API, so cookie auth, redirects, and CSP all work without cross-origin complexity.

Prefer a managed service? Authagonal Cloud runs all of this for you, multi-tenant, every feature on every plan, no per-connection SSO fees. → authagonal.io

Key Features

• OIDC Provider: authorization_code + PKCE, client_credentials, refresh_token, device_code grants with one-time rotation
• SAML 2.0 SP: homebrew implementation with full Azure AD support (signed response, assertion, or both), a per-connection SP keypair for signed AuthnRequests + EncryptedAssertion decryption, and Single Logout (SP- and IdP-initiated)
• Dynamic OIDC Federation: connect to Google, Apple, Azure AD, or any OIDC-compliant IdP
• Multi-Factor Authentication: TOTP, WebAuthn/passkeys, recovery codes; per-client policy (Disabled / Enabled / Required) with IAuthHook per-user override, enforced for federated logins too
• SCIM 2.0 Provisioning: inbound user/group provisioning from Entra ID, Okta, OneLogin; cursor-paged listing and blind-index-backed eq filters
• OAuth Consent Screen: per-client consent with scope-aware re-prompt and grant management
• Device Authorization Grant: RFC 8628 flow for input-constrained devices (smart TVs, CLIs, IoT)
• Token Introspection: RFC 7662 for resource servers to verify token validity
• Token signing: ES256 only. Access tokens carry the RFC 9068 typ: at+jwt so a resource server can tell them from id_tokens and logout tokens, but RFC 9068 conformance is not claimed — §2.1 requires RS256 among the supported algorithms, and this server neither issues nor accepts it. A single algorithm is a deliberate posture: every additional accepted algorithm is another way for a verifier to be talked into the wrong one.
• Back-Channel Logout: OIDC Back-Channel Logout 1.0 notifications to relying parties
• GDPR Self-Service (Authagonal Cloud): data export and scheduled account deletion from the hosted account page. The login app ships the UI for it, but the endpoints it calls — GET /api/v1/account/export, POST /api/v1/account/erasure — are served by the Cloud auth host and are not part of this library’s surface. A self-hosted deployment must implement them, or leave the two buttons out of its account page: MapFallbackToFile answers an unimplemented route with 200 and the SPA’s own HTML, so an export that is not implemented has to be recognised rather than downloaded.
• TCC Provisioning: Try-Confirm-Cancel provisioning into downstream apps at authorize time
• Brandable Login UI: runtime-configurable via a JSON file, logo, colors, CSS custom properties, no rebuild needed; localized into 10 languages
• Auth Hooks: IAuthHook extensibility for audit logging, custom validation, webhooks
• PII Encryption Seams: IFieldCipher / IIndexTokenizer extension points for field-level encryption at rest with keyed blind-index (HMAC) search; recovery codes encrypted via ISecretProvider
• HashiCorp Vault Transit client: sign/verify, encrypt/decrypt and keyed HMAC against Vault’s Transit engine, for building an IFieldCipher or IIndexTokenizer. Remote JWT signing is not wired: the token-signing key is always the one in ISigningKeyStore.
• Composable Library: AddAuthagonal() / UseAuthagonal() to host in your own project with custom service overrides
• Native AOT Ready: IL trimming and source-generated JSON serialization for fast startup
• Pluggable storage: self-hosted PostgreSQL or SQLite (no cloud account), or Azure Table Storage / AWS (DynamoDB / S3 / Secrets Manager) for low-cost serverless-friendly backends
• Backup & Restore: incremental backups (change-log-driven with a full-scan backstop), integrity verification, tombstone-based delete tracking
• Admin APIs: user CRUD, SAML/OIDC provider management, SSO domain routing, token impersonation

Common Integrations

Task-oriented guides for the flows teams build most often:

• Upgrading a User — turn a guest / SSO / invite account into a credentialed one via the passwordless account claim, and run your guest → standard-member promotion on confirm.
• Self-Service SSO — JIT provisioning for enterprise connections: invite-only vs. self-service onboarding, keeping external IdPs from becoming foot-guns, and pre-federation interstitials.
• Federated Sessions — revoke the local session when the upstream IdP does (RevalidateOnRefresh).
• WebSocket Auth — authenticate browser WebSockets through the BFF without exposing a token.
• Agentic Auth — delegate a user’s authority to AI agents: registered agents, fine-grained RFC 9396 authority, composite delegation tokens (RFC 8693 act), standing consent, just-in-time approvals, capability tickets.

Architecture

Client App                    Authagonal                         IdP (Azure AD, etc.)
    │                             │                                    │
    ├─ GET /connect/authorize ──► │                                    │
    │                             ├─ 302 → /login (SPA)                │
    │                             │   ├─ SSO check                     │
    │                             │   └─ SAML/OIDC redirect ─────────► │
    │                             │                                    │
    │                             │ ◄── SAML Response / OIDC callback ─┤
    │                             │   └─ Create user + cookie          │
    │                             │                                    │
    │                             ├─ TCC provisioning (try/confirm)    │
    │                             ├─ Issue authorization code          │
    │ ◄─ 302 ?code=...&state=... ┤                                    │
    │                             │                                    │
    ├─ POST /connect/token ─────► │                                    │
    │ ◄─ { access_token, ... } ──┤                                    │

Get started with the Installation guide or jump straight to the Quick Start. To host Authagonal in your own project, see Extensibility. For data management, see Backup & Restore. For the full change history, see the Changelog.