--- title: "Independent senior .NET consultant, specialising in identity and security" description: "I am an independent senior .NET consultant in Göteborg. I work with IdentityServer, OpenID Connect, security reviews, architecture and coding agents." url: https://tn-data.se/consulting/ type: hub lang: en alternate: https://tn-data.se/sv/konsult.md site: https://tn-data.se/ --- # Independent senior .NET consultant, specialising in identity and security I help .NET teams with the parts of a system that are hard to get right: login, access control and the security around them. I also work with architecture, backend development and, more recently, coding agents. Quick facts - **Based in:** Göteborg, Sweden. On-site, hybrid or remote. - **Specialty:** authentication, identity and security in .NET (OpenID Connect, OAuth, Duende IdentityServer) - **Recognition:** [Microsoft .NET MVP](https://mvp.microsoft.com/en-US/mvp/profile/5150f7cb-54d8-48d8-a450-46b2b677d634) since 2024 - **Experience:** professional developer since 1998, .NET since 2002 - **Teaching:** building and delivering [courses](https://tn-data.se/courses/) since 2010 - **Speaking:** conferences such as NDC, Øredev and Swetugg - **Languages:** Swedish and English ![Tore Nestenius presenting at the Øredev conference in Malmö, November 2024.](https://tn-data.se/_astro/PXL_20241108_130125021-1024x769.BV6HvCXI_ANBEo.webp) ## Identity and OpenID Connect I set up, review and fix authentication in ASP.NET Core applications: Duende IdentityServer, OpenID Connect, OAuth and the BFF pattern for single-page apps. That can be a new IdentityServer installation, an upgrade from IdentityServer4, or finding out why tokens, claims or cookies don’t behave the way you expect. - Service: [IdentityServer consulting and training](https://tn-data.se/duende-identityserver-consulting-services/) - Guide: [OpenID Connect for Developers](https://tn-data.se/openid-connect/) - Dometrain courses: [Getting Started: OpenID Connect](https://tn-data.se/courses/getting-started-openid-connect/) and [Getting Started: Authentication and Authorization in .NET](https://tn-data.se/courses/getting-started-authentication-and-authorization-in-dotnet/) - Workshop: [Introduction to OpenID Connect and OAuth](https://tn-data.se/courses/introduction-to-openid-connect-and-oauth/) - Blog: [Duende IdentityServer 7: A Complete Setup Guide for ASP.NET Core](https://nestenius.se/net/duende-identityserver-7-a-complete-setup-guide-for-asp-net-core/) ![Tore Nestenius presenting about authentication at the Copenhagen .NET User Group](https://tn-data.se/_astro/IMG_2248_png-1024x768.DQALO81k_Z1YJ5Fx.webp) ## Security I review the security of web applications, with a focus on authentication and authorization in ASP.NET Core. I look at how the application handles cookies, tokens and sessions, and where an attacker could get in. You get a list of concrete findings, and I explain them to the team so the same mistakes don’t come back. - Talk: [Top Authentication Fails in ASP.NET Core (and How to Avoid Them)](https://tn-data.se/talks/openid-connect/#top-authentication-fails-in-aspnet-core-and-how-to-avoid-them) - Blog: [Improving ASP.NET Core Security By Putting Your Cookies On A Diet](https://nestenius.se/net/improving-asp-net-core-security-by-putting-your-cookies-on-a-diet/) - Workshop: [Web Security Fundamentals](https://tn-data.se/courses/web-security-fundamentals/) ## Software Architecture I do architecture and code reviews, and technical due diligence, where I go through a large .NET codebase and report on its state. I have taught domain-driven design, CQRS and event sourcing for more than ten years, and I co-created [cqrs.nu](https://cqrs.nu/). If your team wants to use these patterns, I can help you decide where they fit and where they don’t. - Guide: [cqrs.nu](https://cqrs.nu/), CQRS and event sourcing, with a starter kit for .NET - Workshop: [DDD, CQRS and Event Sourcing in .NET](https://tn-data.se/courses/ddd-cqrs-and-event-sourcing-in-net/) - Blog: [Discovering .NET codebases using code coverage and NCrunch](https://nestenius.se/net/discovering-net-codebases-using-code-coverage-and-ncrunch/) ## Backend development I build backend systems in C# and ASP.NET Core, mostly APIs and services, and I have worked with .NET since 2002. When the system runs on Azure, I work with that as well. I hold the AZ-204 Azure Developer certification and wrote the open-source [Cloud Debugger for Azure](https://github.com/tndata/CloudDebugger). - Workshop: [Building ASP.NET Core APIs](https://tn-data.se/courses/building-asp-net-core-apis/) - Workshop: [ASP.NET Core Fundamentals](https://tn-data.se/courses/asp-net-core-fundamentals/) - Previous workshop: [Introduction to Azure for Developers](https://tn-data.se/courses/introduction-to-azure-for-developers-workshop/) - Blog: [Introducing the Cloud Debugger for Azure](https://nestenius.se/azure/introducing-the-cloud-debugger-for-azure/) - Blog: [DefaultAzureCredentials Under the Hood](https://nestenius.se/azure/default-azure-credentials-under-the-hood/) ## Agentic development I help teams start using coding agents such as Claude Code in real projects, in a way that fits how they already work. I use Claude Code every day myself. I also built the Coding Agent Explorer, an open-source tool that shows what an agent actually does: every request, tool call and token count. - Talk: [How Coding Agents Actually Work: Tools, MCP, and the Agent Loop](https://tn-data.se/talks/ai-development/) - Blog: [Introducing the Coding Agent Explorer (.NET)](https://nestenius.se/ai/introducing-the-coding-agent-explorer-net/) - Blog: [Exploring Claude Code Hooks with the Coding Agent Explorer (.NET)](https://nestenius.se/ai/exploring-claude-code-hooks-with-the-coding-agent-explorer-net/) ## How I work I’m based in Göteborg and work on-site in Sweden and abroad, or remotely. Depending on what you need, I work in one or more of these ways: - Hands-on development: I join your team and write code. - Advisory: reviews, second opinions and guidance for your developers, for when you need an experienced view but not a full-time consultant. - Training and talks: I have trained developers since 2010, and I teach the same subjects I consult in. See my [workshops](https://tn-data.se/courses/) and [talks](https://tn-data.se/talks/). The first step is a short call or meeting, with no obligation, so I can understand what you need. [Contact me](https://tn-data.se/contact/) to set one up.