Identity Base
Identity Base packages ASP.NET Core Identity, OpenIddict, MFA, and admin APIs into an open-source platform you can self-host or embed inside existing applications.
Modern Identity, Ready on Day One
Identity Base gives .NET teams a fully wired authentication platform that they can run themselves or embed inside an existing host. The solution layers ASP.NET Core Identity, OpenIddict, Entity Framework Core migrations, MailJet email delivery, and hardened defaults behind a cohesive setup so that teams ship sign-in experiences without weeks of boilerplate.
- Self-host or embed the included OpenIddict authority with warm configuration defaults.
- Stay modular with Identity.Base core packages and optional ASP.NET, Roles, and Admin extensions.
- Protect users with MFA, external providers, and return URL validation out of the box.
- Ship faster using the MIT-licensed codebase, GitHub Actions pipeline, and seeded sample configuration.
The project is built in partnership with VA Software Solutions and stands on the shoulders of the OpenIddict community. Their protocol work powers the secure OpenID Connect surface that Identity Base exposes.
Built-In Guardrails
- Normalized return URLs and dedicated request logging filters keep redirects and telemetry safe.
- Health checks cover database connectivity, MailJet readiness, and external identity providers.
- Configuration validators fail fast on missing secrets, mismatched scopes, or insecure defaults.
Developer Experience
- Opinionated defaults paired with fluent extension points for option validators and custom templated emails.
- CI/CD via GitHub Actions builds, tests, and packages every change so releases stay predictable.
- Sample client and API projects demonstrate SPA sign-in, admin flows, and downstream token validation.
Quick Start for .NET
Identity Base expects PostgreSQL 16+, the .NET SDK, and MailJet credentials. Clone the repository, configure appsettings.Development.json, and run:
dotnet restore Identity.sln
dotnet build Identity.sln
dotnet ef database update \
--project Identity.Base/Identity.Base.csproj \
--startup-project Identity.Base.Host/Identity.Base.Host.csproj
dotnet run --project Identity.Base.Host/Identity.Base.Host.csproj
From there you can register OpenIddict clients, configure MFA policies, and integrate external providers without touching the underlying protocol plumbing.
Where Identity Base Fits
- Self-managed identity server: Run the Identity.Base.Host project to serve browsers, SPAs, mobile apps, and downstream APIs.
- Drop-in authentication layer: Reference Identity.Base packages from an existing host to reuse the same pipeline.
- API protection: Add Identity.Base.AspNet to enforce scope-driven authorization with one-line middleware and helpers.
- Multi-channel experiences: Ship turnkey email, SMS, and authenticator flows governed by configuration, not code.
Extension Packages
Identity Base ships dedicated NuGet packages so you only pull what you need:
- Identity.Base – core services, OpenIddict orchestration, configuration validators.
- Identity.Base.AspNet – ASP.NET helpers for protecting resource servers with Identity Base tokens.
- Identity.Base.Roles – EF Core-backed roles, permissions, seeding helpers, and user-permission endpoints.
- Identity.Base.Admin – protected admin APIs, role assignment workflows, and audit-ready handlers.
Read the launch post for a deeper tour of the surface area and operations guidance.
Identity Base Updates
See all updatesIdentity Base 0.7.9: Security-First Defaults, SendGrid Support, and Angular SDKs
Identity Base 0.7.9 removes ROPC password grant, adds SendGrid email support, ships first-class Angular packages, and hardens security defaults. This post covers notable changes since 0.7.4 and how to migrate.
Identity Base 0.7.4: Unified Lifecycle Hooks and Notification Augmentors
Unified lifecycle listeners and notification augmentors add before/after extensibility plus customizable email pipelines without forking Identity Base.
Identity Base 0.7.1: Provider-Agnostic Database Support
Identity Base no longer depends on PostgreSQL. Choose any EF Core provider - SQL Server, PostgreSQL, SQLite, MySQL - and generate migrations in your host application. Learn how this architectural change enables database flexibility and what it means for your integration.
Launch Resources
Read the full launch announcement, browse docs, and file issues directly from the repository.
Key Features
OpenID Connect authority with password, authorization-code PKCE, refresh tokens, and seeded clients
Multi-factor authentication pipelines covering authenticator apps, SMS, email, and recovery codes
External identity providers baked in for Google, Microsoft, Apple, plus extensibility hooks for others
NuGet packages for the core runtime, ASP.NET helpers, role-based access control, and admin APIs
MailJet-powered communications templates for onboarding, reset, MFA, and operational alerts
Secure defaults including normalized return URLs, configurable logging, health checks, and option validation
Ready to get started?
Join thousands of users who trust Identity Base for their AI needs.