Starter docs

OpenIddict for identity

The problem it solves

A SaaS product needs more than "sign in": confirmed e-mail addresses, two-factor, social sign-in, tokens for scripts, organizations connecting their own identity provider, SCIM. And its sign-in pages are part of the product — translated and styled like the rest of it.

The Starter runs its own OpenID Connect server, Blouppy.Identity, built on OpenIddict and ASP.NET Identity:

  • The pages are yours — Razor pages in the same repository, with the design system's tokens, the app's languages and a development sign-in panel.
  • The protocol is standard — the gateway, the API and any client speak plain OpenID Connect, so the identity host could be replaced without touching them.
  • The data is yours — accounts live in your PostgreSQL, next to the rest.
  • The licence is Apache 2.0, with no revenue threshold and no key to configure. The project the Starter comes from first ran on Duende IdentityServer, which is commercial in production; it was replaced for that reason, keeping the same shape.

What it costs

  • You operate an identity server: its signing keys (generated and stored encrypted in the database, or your own certificates), its token table (pruned hourly), its security updates.
  • OpenIddict is a toolkit, not a product. The protocol endpoints are OpenIddict's, but who is signed in, what was consented and which claims each token carries is the Starter's code (ConnectController, UserPrincipalFactory) — readable, and yours to maintain.
  • A second ASP.NET Core application, with its own DbContext and migrations.

What you can relax

  • Turn off what you do not sell. GitHub and Google sign-in and the CAPTCHA are off when their keys are left empty, and single sign-on is offered only on the plans that include it.
  • Use a hosted identity provider instead. The gateway uses Microsoft's standard OpenID Connect handler and the API validates standard JWTs, so pointing them at another provider is configuration. You would lose the features that live in the identity host itself: personal access tokens, SSO and SCIM for organizations, the account pages.