Fundamentals
Duende IdentityServer implements the OpenID Connect, OAuth and SAML protocol layers: issuing tokens, managing clients and scopes, and enforcing authorization policies. This section covers everything fundamental to working with IdentityServer, from the core concepts you need to understand to the components you provide.
Core concepts
Section titled “Core concepts”These are the core concepts you’ll work with when configuring and running IdentityServer:
- Clients — A client is any application that requests tokens from IdentityServer, whether a web app, SPA, mobile app, API, or backend service. Each client is registered with an allowed set of scopes, grant types, and redirect URIs. See Clients.
- Resources — Resources model what your system protects. Identity resources represent user claims (like profile or email), API scopes define logical permission boundaries, and API resources group scopes for audience-based access control. See Resources.
- Claims — Claims are name-value pairs that describe a user or client. They flow through tokens and are the primary way downstream applications learn about the authenticated entity. Understanding how claims are requested, issued, and transformed is central to working with IdentityServer. See Claims and Claims Lifecycle.
- Users — Users are the people who authenticate through IdentityServer. How users are modeled, stored, and resolved into claims depends on your identity management choice. See Users.
- Key Management — IdentityServer uses cryptographic keys to sign tokens. Key management covers how signing keys are created, rotated, and stored, which is critical for production deployments. See Key Management.
- Hosting — IdentityServer runs as middleware in an ASP.NET Core application. Hosting covers how to configure the host, set up endpoints, and prepare for production deployment. See Hosting.
- Events — IdentityServer raises events for key operations like token issuance, login, and errors. These are useful for auditing, monitoring, and diagnostics. See Events.
What you provide
Section titled “What you provide”IdentityServer handles protocols, but it relies on you for three things: a user interface, data storage, and identity management.
User Interface
Section titled “User Interface”IdentityServer has no built-in UI. It relies on pages you provide for login, logout, consent, and error handling. This keeps you in full control of the user experience: credential types, visual design, multi-factor flows, and any additional pages (registration, password reset, etc.) are all yours to build.
Ready-made UI is available via the IdentityServer templates, which give you a working starting point that you can customize completely. See User Interface for full coverage of login, logout, consent, and more.
Data Stores
Section titled “Data Stores”IdentityServer needs two kinds of persistent data:
- Configuration data: clients, resources, and identity providers. Defines what your IdentityServer deployment supports.
- Operational data: tokens, authorization codes, grants, and sessions. Generated at runtime during authentication flows.
All data access is behind store interfaces, so you can use any database. Ready-made providers are available, or you can implement the interfaces yourself. See Data Stores & Persistence for the full details.
Identity & Profile Management
Section titled “Identity & Profile Management”IdentityServer needs to know who your users are and what claims to include in their tokens. It does not have a built-in user database; you connect it to yours via the IProfileService interface.
Ready-made integrations are available for User Management and ASP.NET Identity, or you can implement IProfileService yourself to connect to any user store.