Introduction to IdentityServer and OpenID Connect
Learn how OpenID Connect and OAuth work, how to set up Duende IdentityServer, and how to secure ASP.NET Core applications with it.
No longer offered as a standard course. Get in touch if you need training in this area.
Modern applications need authentication and authorization for everything from web apps, SPAs and mobile apps to microservices in the cloud. OpenID Connect is the standard for this, but its many concepts (scopes, claims, flows, resources and tokens) can be confusing.
In this three-day workshop you set up Duende IdentityServer 7.x and use it to secure ASP.NET Core applications. We look under the hood of OpenID Connect and IdentityServer to see how they actually work, and you practise each part in hands-on exercises.
What You Will Learn
- How OAuth and OpenID Connect work together in detail
- How to set up an instance of IdentityServer
- How to secure ASP.NET Core applications using OpenID Connect and IdentityServer
After this workshop, I recommend IdentityServer in Production, where you learn how to set up IdentityServer for production.
Who Is This Workshop For?
ASP.NET Core developers who want to learn the fundamentals of OpenID Connect and how to protect applications with Duende IdentityServer.
Prerequisites
To get the most from the workshop, you should have a basic knowledge of:
- ASP.NET Core (like my ASP.NET Core Fundamentals workshop)
- C#, including LINQ and lambda expressions
- The HTTP(S) protocol and how the web works in general
- HTML
You also need a computer that can run several instances of Visual Studio, and at least one large monitor. The workshop uses ASP.NET Core 10 and Duende IdentityServer 7.x.
Workshop Agenda
During the workshop, we cover the following topics.
- OAuth 2.1 / OpenID Connect
- Certificates and HTTPS
- Token services
- Duende IdentityServer
- JSON Web Tokens (JWT)
- Scopes and claims
- Identity resources
- API resources
- APIScopes
- Securing the tokens
- Cross-origin resource sharing (CORS)
- Flows
- Implicit flow (and why it is deprecated)
- Authorization code flow
- Client credentials flow
- Proof Key for Code Exchange (PKCE)
- External identity providers
- Application types:
- Web applications
- SPA and mobile applications
- Server-to-server communication
- ASP.NET Core
- Authentication
- Cookie authentication
- Authorization
- OpenID Connect
- Claims transformations
Resources
Looking for help with your IdentityServer project, or want to learn more about OpenID Connect? These links may be useful:
- My introductory guide to OpenID Connect and its authentication flows.
- My IdentityServer services: how I can help you build authentication and authorization solutions for your needs.
Video Courses on Dometrain
Do you want to learn the fundamentals on your own, at your own pace? I have two video courses on Dometrain:
Getting Started: OpenID Connect
OAuth and OpenID Connect at the protocol level, including tokens, signing and the flows. It works whatever language or platform you use.
Getting Started: Authentication and Authorization in .NET
What happens inside ASP.NET Core when a user signs in, from the authentication middleware and cookies to authorization.
About the Trainer
My name is Tore Nestenius. I teach on-site and remotely, both directly for companies and through training companies in Europe. What I bring:
- I have trained developers since 2010 and taught several hundred courses and talks.
- I create, maintain and teach every course myself, and improve it after every delivery.
- I am a Microsoft .NET MVP.
- I am the author of two video courses on Dometrain, on authentication and authorization in .NET and on OpenID Connect.
- I speak at conferences such as NDC, Øredev and Swetugg.
- I co-founded Edument, a Swedish training and consulting company, where I was CTO, developer and trainer.
- I work as an independent senior .NET consultant, so I teach from real projects.
- I have worked as a developer for more than 25 years, and with .NET since it launched in 2002.
- I co-founded the .NET Skåne user group.
Intro to IdentityServer and OpenID Connect
Duration
3 days
Level
Intermediate
Language
English, Swedish
Training FAQs
Do you provide both on-site and remote training classes?
Yes, I provide both on-site and remote types of training.
Do you provide training in both Swedish and English?
Yes, both Swedish and English are available. All my course materials are in English and I can teach the class in either Swedish or English.
Do you do half-day training?
For remote training, I have options for both half and full days. When I run training on-site, I usually do full-day classes.
Do you do webinars and shorter talks?
Yes, please visit my Talks page for more details.