Duende Software Open Source Libraries

Duende.IdentityModel is a .NET library designed for claims-based identity, OAuth 2.0, and OpenID Connect. It provides a standardized object model to interact with OAuth and OpenID Connect specification endpoints.

Key features include:

• Request/Response Types: Strongly typed objects representing specification-defined requests and responses.
• Extension Methods: Methods to simplify invoking identity-related requests.
• Specification Constants: Pre-defined constants for standard scopes, claims, and parameter names.
• Convenience Methods: Utilities for performing common identity operations.

Compatibility: The library targets .NET Standard 2.0, ensuring it can be used in both .NET and .NET Framework applications.

This project is designed to facilitate the analysis of trimmable warnings in .NET applications. Trimming is a deployment technique that reduces the size of your application by removing unused code. This project helps identify potential issues where code might be incorrectly removed during the trimming process.

For detailed information on how to prepare libraries for trimming in .NET, refer to the official Microsoft documentation.

Duende.IdentityModel.OidcClient is an OpenID Connect (OIDC) client library designed specifically for native applications. It targets .NET Standard, ensuring compatibility with both .NET and .NET Framework.

The library provides two levels of functionality:

1. Low-level: Types for describing OIDC requests and responses, and methods to construct protocol state and handle responses.
2. High-level: Simplified methods for common OIDC workflows including:
   • Logging in
   • Logging out
   • Retrieving userinfo
   • Refreshing tokens

This repository serves as a collection of Duende's open-source .NET libraries focused on identity, OAuth 2.0, and OpenID Connect. These libraries are maintained by Duende Software and are designed to be interoperable.

Available projects include:

• Duende.AccessTokenManagement: .NET libraries for managing OAuth and OpenID Connect access tokens.
• Duende.AspNetCore.Authentication.OAuth2Introspection: An ASP.NET Authentication handler specifically for OAuth 2.0 introspection.
• Duende.IdentityModel: .NET libraries for claims-based identity, OAuth 2.0, and OpenID Connect.
• Duende.IdentityModel.OidcClient: .NET libraries for building OpenID Connect (OIDC) native clients.

Duende.AccessTokenManagement.OpenIdConnect is a .NET library designed for ASP.NET Core applications to manage OpenId Connect access tokens.

Key capabilities include:

• Automatic Token Acquisition: Automatically acquires new tokens before existing ones expire.
• HTTP Client Integration: Provides conveniences to automatically attach the current valid token to outgoing HTTP requests.
• Token Revocation: Can revoke refresh tokens that are no longer required by the application.

Duende.IdentityModel.OidcClient.Extensions is an add-on package for the core Duende.IdentityModel.OidcClient library. It provides advanced features that require additional dependencies not present in the core package, helping to avoid transitive dependency conflicts in your project.

Currently, the primary feature provided by this extensions package is support for DPoP (Demonstrating Proof-of-Possession) extensions, which are used for sender-constraining tokens according to RFC 9449.

Duende.AccessTokenManagement is a set of .NET libraries designed to manage OAuth and OpenID Connect access tokens. It automates several key token lifecycle tasks:

• Automatic Acquisition: Automatically requests new tokens before existing ones expire.
• HTTP Client Integration: Provides conveniences for attaching the current valid token to outgoing HTTP requests.
• Token Revocation: Provides mechanisms to revoke tokens that are no longer required.

Duende.RazorSlices is a vendored fork of the DamianEdwards/RazorSlices project. It is maintained by Duende for supply-chain control, allowing for independent security patching and pinned source versions. It enables the use of Razor files as request handlers in ASP.NET Core applications.

Key changes from the upstream version:

• The namespace, package ID, and assembly name have been updated to use the Duende.* prefix.
• The source generator package is now Duende.RazorSlices.SourceGenerator.
• The target framework has been updated to net10.0.

This sample demonstrates how to build a Windows desktop application using WPF and Duende.IdentityModel.OidcClient. It implements a secure authentication flow using the following patterns:

• Manual Mode: Uses the system browser for interactive protocol flows.
• Custom URI Schemes: Listens for callbacks on a private-use URI scheme to avoid firewall or port-blocking issues.
• DPoP (Demonstrating Proof-of-Possession): Protects obtained tokens from replay attacks by binding them to a secret key.
• DPAPI Protection: Uses the operating system's Data Protection API (DPAPI) to protect the DPoP key and stored session information.

When working with token management and identity, you may need these related libraries:

• Duende.IdentityModel: The foundational library for claims-based identity, OAuth 2.0, and OpenId Connect.
• Duende.AccessTokenManagement: Specifically for token management in machine-to-machine (M2M) workflows within .NET worker services.