<p>OpenIddict is <strong>an open source and versatile framework for building standard-compliant OAuth 2.0/OpenID Connect servers</strong>
in any ASP.NET Core 2.1 (and higher) and legacy ASP.NET 4.6.1 (and higher) applications.</p>
<p>OpenIddict was born in late 2015 and was initially based on <ahref="https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server">AspNet.Security.OpenIdConnect.Server</a>
(codenamed ASOS), a low-level OpenID Connect server middleware inspired by the OAuth 2.0 authorization server middleware developed by Microsoft for the OWIN project
and the first OpenID Connect server ever created for ASP.NET Core.</p>
<p>In 2020, ASOS was merged into OpenIddict 3.0 to form a unified stack under the OpenIddict umbrella, while still offering an easy-to-use approach for new users
and a low-level experience for advanced users thanks to a "degraded mode" that allows using OpenIddict in a stateless way (i.e without a backing database).</p>
<p>As part of this process, native support for <code>Microsoft.Owin</code> was added to OpenIddict 3.0 to allow using it in legacy ASP.NET 4.6.1 (and higher) applications,
making it an excellent candidate for replacing <code>OAuthAuthorizationServerMiddleware</code> and <code>OAuthBearerAuthenticationMiddleware</code> without having to migrate to ASP.NET Core.</p>
<p>Unlike other solutions, <strong>OpenIddict exclusively focuses on the OAuth 2.0/OpenID Connect protocol aspects of the authorization process</strong>
and leaves user authentication up to the implementer: OpenIddict can be natively used with any form of user authentication like password, token,
federated or Integration Windows Authentication. While convenient, using a membership stack like ASP.NET Core Identity is not required.</p>
<p>Integration with OpenIddict is typically done by enabling the pass-through mode to handle requests in a controller action
or in a minimal API handler or, for more complex scenarios, by directly using its advanced events model.</p>
<h3id="pass-through-mode">Pass-through mode</h3>
<p>As with <code>OAuthAuthorizationServerMiddleware</code>, OpenIddict allows handling authorization, logout and token requests in custom controller actions or any other
middleware able to hook into the ASP.NET Core or OWIN request processing pipeline. In this case, OpenIddict will always validate incoming requests first
(e.g by ensuring the mandatory parameters are present and valid) before allowing the rest of the pipeline to be invoked: should any validation error occur,
OpenIddict will automatically reject the request before it reaches user-defined controller actions or custom middleware.</p>
<p>OpenIddict implements a powerful event-based model for its server and validation stacks: each part of the request processing logic is implemented as an event handler
that can be removed, moved to a different position in the pipeline or replaced by a custom handler to override the default logic used by OpenIddict:</p>
<pre><codeclass="lang-csharp">/// <summary>
/// Contains the logic responsible of rejecting authorization requests that don't specify a valid prompt parameter.
/// </summary>
public class ValidatePromptParameter : IOpenIddictServerHandler<ValidateAuthorizationRequestContext>
{
/// <summary>
/// Gets the default descriptor definition assigned to this handler.
/// </summary>
public static OpenIddictServerHandlerDescriptor Descriptor { get; }
