Duende IdentityServer implements the following specifications:
| Specification | Reference |
|---|
| OpenID Connect Core 1.0 | Spec |
| OpenID Connect Discovery 1.0 | Spec |
| OpenID Connect RP-Initiated Logout 1.0 | Spec |
| OpenID Connect Session Management 1.0 | Spec |
| OpenID Connect Front-Channel Logout 1.0 | Spec |
| OpenID Connect Back-Channel Logout 1.0 | Spec |
| Multiple Response Types | Spec |
| Form Post Response Mode | Spec |
| OpenID Connect Client-Initiated Backchannel Authentication (CIBA) | Spec |
| FAPI 2.0 Security Profile | Spec |
| Specification | Reference |
|---|
| OAuth 2.0 | RFC 6749 |
| OAuth 2.0 Bearer Token Usage | RFC 6750 |
| JSON Web Token (JWT) | RFC 7519 |
| OAuth 2.0 Token Revocation | RFC 7009 |
| OAuth 2.0 Token Introspection | RFC 7662 |
| Proof Key for Code Exchange by OAuth Public Clients (PKCE) | RFC 7636 |
| Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants | RFC 7521 |
| OAuth 2.0 JSON Web Tokens for Client Authentication | RFC 7523 and RFC 7523bis |
| OAuth 2.0 Device Authorization Grant | RFC 8628 |
| Proof-of-Possession Key Semantics for JSON Web Tokens | RFC 7800 |
| OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens | RFC 8705 |
| OAuth 2.0 Token Exchange | RFC 8693 |
| JWT Secured Authorization Request (JAR) | RFC 9101 |
| JWT Profile for OAuth 2.0 Access Tokens | RFC 9068 |
| OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response | RFC 9207 |
| OAuth 2.0 Step-up Authentication Challenge Protocol | RFC 9470 |
| OAuth 2.0 Dynamic Client Registration Protocol | RFC 7591 |
| OAuth 2.0 Pushed Authorization Requests | RFC 9126 |
| Resource Indicators for OAuth 2.0 | RFC 8707 |
| OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) | RFC 9449 |
| JSON Web Token (JWT) Response for OAuth Token Introspection | RFC 9701 |
| OAuth 2.0 Authorization Server Metadata | RFC 8414 |
Support for Security Assertion Markup Language (SAML) v2.0:
