IdentityServer Host
Relevant source files
The following files were used as context for generating this wiki page:
- WebApplications/Identity.WebApi/Config/IdentityServerConfig.cs
- WebApplications/Identity.WebApi/Models/ApplicationUser.cs
- WebApplications/Identity.WebApi/Program.cs
- WebApplications/Identity.WebApi/SeedData/IdentitySeedData.cs
- Aspire.AppHost/AppHost.cs
- BuildingBlocks/BuildingBlocks.Infrastructure.Auth/AuthExtensions.cs
- WebApplications/Identity.WebApi.Tests/IdentityServerConfigTests.cs
The IdentityServer Host is a central security component within the DDD project, implemented using Duende IdentityServer 7.4. It serves as the OpenID Connect (OIDC) and OAuth2 authority, providing authentication and authorization services for various microservices and the Angular SPA. The system integrates with ASP.NET Core Identity for user and role management, utilizing Entity Framework Core for persistence of configuration and operational data.
Sources: claude.md:126-128, WebApplications/Identity.WebApi/Program.cs:64-100
Core Architecture
The host is built on .NET 9 and incorporates several specialized stores to manage the identity lifecycle. It utilizes a SQL Server database to store identity data, including users, roles, clients, and scopes.
Component Overview
The IdentityServer Host consists of three primary database contexts:
- IdentityDbContext: Manages ASP.NET Core Identity data (Users and Roles).
- ConfigurationDbContext: Stores OIDC configuration like Clients, API Scopes, and Identity Resources.
- PersistedGrantDbContext: Manages operational data such as tokens, consents, and authorization codes.
Sources: WebApplications/Identity.WebApi/Program.cs:17-100, WebApplications/Identity.WebApi/SeedData/IdentitySeedData.cs:41-52
System Relationships Diagram
The following diagram illustrates how the IdentityServer Host interacts with other system components via the OIDC protocol.
Configuration and Scopes
The system defines resources and scopes that determine what data and permissions are available to clients.
Identity Resources and API Scopes
Identity resources define user identity data (like email or profile), while API scopes define specific permissions for backend services.
| Type | Name | Description |
|---|---|---|
| Identity Resource | openid | Required for OpenID Connect |
| Identity Resource | profile | User profile information (name, etc.) |
| Identity Resource | email | User email address |
| Identity Resource | roles | User role claims |
| API Scope | scheduling_api | Access to the Scheduling Service |
| API Scope | billing_api | Access to the Billing Service |
Sources: WebApplications/Identity.WebApi/Config/IdentityServerConfig.cs:22-36
Client Configuration
The host supports multiple client types, primarily using the Authorization Code Flow with PKCE.
Slot-Aware Port Derivation
For local development and testing across multiple git worktrees, the host implements a "slot" system. This shifts the ports of the IdentityServer and its clients based on a worktree-slot parameter to prevent port collisions.
- Formula:
Port = BasePort + 100 * (Slot - 1) - Default Slot: 1 (Ports: 7010 for Identity, 7001 for Scheduling, 7002 for Billing, 7003 for SPA).
Sources: WebApplications/Identity.WebApi/Config/IdentityServerConfig.cs:14-20, Aspire.AppHost/AppHost.cs:10-30, WebApplications/Identity.WebApi.Tests/IdentityServerConfigTests.cs:10-110
User and Role Management
The host integrates ASP.NET Core Identity to manage users and roles. It is seeded with default roles and users during development.
Default Roles
- Admin: Full system access.
- Doctor: Access to medical/scheduling functions.
- Nurse: Support staff access.
Sources: WebApplications/Identity.WebApi/SeedData/IdentitySeedData.cs:85-98
User Seeding Example
During development, the IdentitySeedData service ensures standard users exist:
admin@test.com(Role: Admin)doctor@test.com(Role: Doctor)nurse@test.com(Role: Nurse)
Sources: WebApplications/Identity.WebApi/SeedData/IdentitySeedData.cs:100-149
Authentication Flow
The host manages the login and logout lifecycle. It specifically handles OIDC challenges and session termination.
Security Configurations
- Data Protection: Shared keys are persisted to the database to allow cookie decryption across multiple API instances. Sources: WebApplications/Identity.WebApi/Program.cs:60-63
- Automatic Key Management: Duende v7+ automatically handles RSA key generation, rotation, and storage. Sources: WebApplications/Identity.WebApi/Program.cs:95-97
- Token Cleanup: The host runs a background service to clean up expired operational data (tokens/consents) every hour. Sources: WebApplications/Identity.WebApi/Program.cs:88-93
Summary
The IdentityServer Host acts as the central trust anchor for the DDD project. By combining Duende IdentityServer with ASP.NET Core Identity, it provides a robust, standards-compliant authentication layer. Its slot-aware configuration allows for seamless parallel development environments, while its automated seeding and migration processes simplify local setup for developers.