Identityserver Configuration

var builder = WebApplication.CreateBuilder(args);
var idsvrBuilder = builder.Services.AddIdentityServer(options =>{    // Let the issuer be inferred from the request URL (recommended)    // options.IssuerUri = "https://identity.example.com"; // Only set when behind a reverse proxy
    // Enable events for diagnostics    options.Events.RaiseErrorEvents = true;    options.Events.RaiseInformationEvents = true;    options.Events.RaiseFailureEvents = true;    options.Events.RaiseSuccessEvents = true;})    .AddInMemoryIdentityResources(Config.IdentityResources)    .AddInMemoryApiScopes(Config.ApiScopes)    .AddInMemoryClients(Config.Clients);
var app = builder.Build();app.UseIdentityServer(); // Includes UseAuthentication()app.UseAuthorization();app.Run();

new Client{    ClientId = "service.worker",    ClientName = "Background Worker Service",
    AllowedGrantTypes = GrantTypes.ClientCredentials,    ClientSecrets = { new Secret("secret".Sha256()) },
    AllowedScopes = { "api1", "api2.read_only" }}

new Client{    ClientId = "web.app",    ClientName = "Web Application",
    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true, // Default is true in Duende IS
    ClientSecrets = { new Secret("secret".Sha256()) },
    // Redirect URIs — must exactly match what the client sends    RedirectUris = { "https://app.example.com/signin-oidc" },    PostLogoutRedirectUris = { "https://app.example.com/signout-callback-oidc" },    FrontChannelLogoutUri = "https://app.example.com/signout-oidc",
    // Enable offline access for refresh tokens    AllowOfflineAccess = true,
    AllowedScopes =    {        IdentityServerConstants.StandardScopes.OpenId,        IdentityServerConstants.StandardScopes.Profile,        IdentityServerConstants.StandardScopes.Email,        "api1"    }}

new Client{    ClientId = "spa.bff",    ClientName = "SPA with BFF",
    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true,    RequireClientSecret = true, // BFF host holds the secret
    ClientSecrets = { new Secret("secret".Sha256()) },
    RedirectUris = { "https://app.example.com/signin-oidc" },    PostLogoutRedirectUris = { "https://app.example.com/signout-callback-oidc" },    BackChannelLogoutUri = "https://app.example.com/bff/backchannel",
    AllowOfflineAccess = true,
    AllowedScopes =    {        IdentityServerConstants.StandardScopes.OpenId,        IdentityServerConstants.StandardScopes.Profile,        "api1"    }}

// Load clients from configurationidsvrBuilder.AddInMemoryClients(    configuration.GetSection("IdentityServer:Clients"));

public static IEnumerable<IdentityResource> IdentityResources =>    new IdentityResource[]    {        new IdentityResources.OpenId(),   // Required — maps to "sub" claim        new IdentityResources.Profile(),  // name, family_name, given_name, etc.        new IdentityResources.Email(),    // email, email_verified        new IdentityResources.Phone(),    // phone_number, phone_number_verified        new IdentityResources.Address(),  // address (JSON object)    };

// ✅ Custom identity resource for tenant membershipnew IdentityResource(    name: "tenant",    displayName: "Your organization info",    userClaims: new[] { "tenant_id", "tenant_name", "tenant_role" }){    Required = true // Do not show on consent screen as optional}

public static IEnumerable<ApiScope> ApiScopes =>    new ApiScope[]    {        // Simple scope — just a name        new ApiScope("api1", "Main API"),
        // Granular scopes for fine-grained access        new ApiScope("catalog.read", "Read product catalog"),        new ApiScope("catalog.write", "Modify product catalog"),        new ApiScope("orders.manage", "Manage orders"),
        // Scope that includes specific user claims in the access token        new ApiScope("invoicing", "Invoicing API")        {            UserClaims = { "department", "cost_center" }        }    };

public static IEnumerable<ApiResource> ApiResources =>    new ApiResource[]    {        new ApiResource("catalog-api", "Product Catalog API")        {            Scopes = { "catalog.read", "catalog.write" },
            // These claims are included when any scope in this resource is requested            UserClaims = { "role" }        },        new ApiResource("orders-api", "Order Management API")        {            Scopes = { "orders.manage" },
            // API-specific secret for reference token introspection            ApiSecrets = { new Secret("orders-secret".Sha256()) }        }    };

// Two separate APIs that both have a "read" scopenew ApiResource("inventory-api") { Scopes = { "read", "write" } },new ApiResource("reporting-api") { Scopes = { "read" } }

var idsvrBuilder = builder.Services.AddIdentityServer(options =>{    // Automatic key management is enabled by default    // Customize rotation policy:    options.KeyManagement.RotationInterval = TimeSpan.FromDays(90);    // New key every 90 days    options.KeyManagement.PropagationTime = TimeSpan.FromDays(14);     // Announce 14 days early    options.KeyManagement.RetentionDuration = TimeSpan.FromDays(14);   // Keep old keys 14 days    options.KeyManagement.DeleteRetiredKeys = true;                    // Clean up old keys
    // Keys are encrypted at rest via ASP.NET Data Protection (default: true)    options.KeyManagement.DataProtectKeys = true;});

options.KeyManagement.SigningAlgorithms = new[]{    // RS256 for maximum compatibility (first = default)    new SigningAlgorithmOptions(SecurityAlgorithms.RsaSha256)    {        UseX509Certificate = true // Wrap in X.509 certificate    },    // PS256 for enhanced security    new SigningAlgorithmOptions(SecurityAlgorithms.RsaSsaPssSha256),    // ES256 for compact tokens    new SigningAlgorithmOptions(SecurityAlgorithms.EcdsaSha256)};

options.KeyManagement.KeyPath = "/home/shared/keys";

var idsvrBuilder = builder.Services.AddIdentityServer(options =>{    options.KeyManagement.Enabled = false;});
// Load key from secure storagevar signingKey = LoadKeyFromVault(); // Your key loading logicidsvrBuilder.AddSigningCredential(signingKey, SecurityAlgorithms.RsaSha256);

// Phase 1: Announce new key (keep signing with old key)idsvrBuilder.AddSigningCredential(oldKey, SecurityAlgorithms.RsaSha256);idsvrBuilder.AddValidationKey(newKey, SecurityAlgorithms.RsaSha256);// Wait for all clients/APIs to refresh their JWKS cache (default: 24h)
// Phase 2: Start signing with new key (keep old key for validation)idsvrBuilder.AddSigningCredential(newKey, SecurityAlgorithms.RsaSha256);idsvrBuilder.AddValidationKey(oldKey, SecurityAlgorithms.RsaSha256);// Wait for all tokens signed with old key to expire
// Phase 3: Remove old keyidsvrBuilder.AddSigningCredential(newKey, SecurityAlgorithms.RsaSha256);

var idsvrBuilder = builder.Services.AddIdentityServer(options =>{    // Remove expired sessions automatically    options.ServerSideSessions.RemoveExpiredSessionsFrequency = TimeSpan.FromMinutes(10);    options.ServerSideSessions.ExpiredSessionsTriggerBackchannelLogout = true;
    // Coordinate client token lifetimes with user sessions    options.Authentication.CoordinateClientLifetimesWithUserSession = true;})    // Server-side sessions are enabled by calling AddServerSideSessions()    .AddServerSideSessions();

options.Events.RaiseErrorEvents = true;options.Events.RaiseInformationEvents = true;options.Events.RaiseFailureEvents = true;options.Events.RaiseSuccessEvents = true;

options.Authentication.CookieLifetime = TimeSpan.FromHours(10);options.Authentication.CookieSlidingExpiration = false;

options.Caching.ClientStoreExpiration = TimeSpan.FromMinutes(15);options.Caching.ResourceStoreExpiration = TimeSpan.FromMinutes(15);

options.PushedAuthorization.Required = true; // Require all clients to use PAR

options.DPoP.ValidationMode = DPoPTokenExpirationValidationMode.Nonce;options.DPoP.ServerClockSkew = TimeSpan.FromMinutes(5);

// ❌ WRONG — OpenID Connect requires the openid scopenew Client{    AllowedScopes = { "profile", "api1" }}
// ✅ CORRECT — Always include openid for interactive clientsnew Client{    AllowedScopes =    {        IdentityServerConstants.StandardScopes.OpenId,        IdentityServerConstants.StandardScopes.Profile,        "api1"    }}

// ❌ WRONG — Trailing slash mismatch causes "invalid_redirect_uri" errorRedirectUris = { "https://app.example.com/signin-oidc/" }// Client sends:   https://app.example.com/signin-oidc (no trailing slash)
// ✅ CORRECT — Exact match requiredRedirectUris = { "https://app.example.com/signin-oidc" }

// ❌ WRONG — No audience claim, tokens work at any APIpublic static IEnumerable<ApiScope> ApiScopes =>    new[] { new ApiScope("read"), new ApiScope("write") };
// ✅ CORRECT — API resource sets audience for token isolationpublic static IEnumerable<ApiResource> ApiResources =>    new[]    {        new ApiResource("my-api")        {            Scopes = { "read", "write" }        }    };

// ❌ WRONG — Secret in source codeClientSecrets = { new Secret("my-production-secret".Sha256()) }
// ✅ CORRECT — Load from configuration or vaultClientSecrets = { new Secret(configuration["Clients:Web:Secret"].Sha256()) }
// ✅ ALSO CORRECT — Use asymmetric credentials (no shared secret)// Client authenticates with a signed JWT assertion

// ❌ Client requests "offline_access" scope but server doesn't allow itvar client = new Client{    AllowedGrantTypes = GrantTypes.Code,    AllowOfflineAccess = false, // Default    AllowedScopes = { "openid", "api1" }};// Client silently won't receive a refresh token
// ✅ Enable offline access explicitlyvar client = new Client{    AllowedGrantTypes = GrantTypes.Code,    AllowOfflineAccess = true,    AllowedScopes = { "openid", "api1" }};

// ❌ IdentityServer behind Nginx but IssuerUri defaults to internal hostname// Tokens contain iss: "http://internal-host:5000" — clients reject them
// ✅ Set IssuerUri to the external URLoptions.IssuerUri = "https://identity.example.com";