AspNet.Security.OAuth.Providers

AspNet.Security.OAuth.Providers is a collection of security middleware that you can use in your ASP.NET Core application to support social authentication providers like GitHub, Twitter/X or Dropbox. It is directly inspired by Jerrie Pelser's initiative, Owin.Security.Providers.

The latest official release can be found on NuGet and the nightly builds on MyGet.

[!TIP] While the aspnet-contrib providers are still fully supported, developers are encouraged to use the OpenIddict client for new applications.

For information, see the Migrating to OpenIddict section.

Getting started

Adding social authentication to your application is a breeze and just requires a few lines in your Startup class:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(options => { /* Authentication options */ })
            .AddGitHub(options =>
            {
                options.ClientId = "49e302895d8b09ea5656";
                options.ClientSecret = "98f1bf028608901e9df91d64ee61536fe562064b";
            });
}

public void Configure(IApplicationBuilder app)
{
    app.UseAuthentication();
    app.UseAuthorization();
}

See the /samples directory for a complete sample using ASP.NET Core MVC and supporting multiple social providers.

Contributing

AspNet.Security.OAuth.Providers is actively maintained by:

• Kévin Chalet (@kevin_chalet).
• Martin Costello (@martin_costello).

We would love it if you could help contributing to this repository.

Special thanks to our contributors:

• Aaron Sadler
• Abhinav Nigam
• Adam Reisinger
• Albert Zakiev
• Albireo
• Anders Blankholm
• Andrew Lock
• Andrew Mattie
• Andrii Chebukin
• Anthony Yates
• Chino Chang
• Chris Sung
• CoCo Lin
• Dave Timmins
• Dmitry Popov
• Drew Killion
• Elan Hasson
• Eric Green
• Ethan Celletti
• Floris Westerman
• Galo
• Gehongyan
• Igor Simovic
• James Holcomb
• Jason Loeffler
• Jerrie Pelser
• Jesse Mandel
• Jordan Knight
• Kévin Chalet
• Konstantin Mamaev
• LeaFrock
• Levi Muriuki
• Luke Fulliton
• Mariusz Zieliński
• Martin Costello
• Matthew Moore
• Maxime Roussin-Bélanger
• Michael Knowles
• Michael Tanczos
• Patrick Westerhoff
• Robert Shade
• saber-wang
• Sinan
• Stefan
• Steffen Wenz
• Tathagata Chakraborty
• TheUltimateC0der
• Tolbxela
• Tommy Parnell
• twsl
• wplong11
• Yannic Smeets
• zAfLu
• zhengchun
• Vicente Yu
• Volodymyr Baydalka
• Logan Dam

Security policy

Please see SECURITY.md for information about reporting security issues and bugs.

Support

Need help or wanna share your thoughts? Don't hesitate to join us on Gitter or ask your question on StackOverflow:

• Gitter: https://gitter.im/aspnet-contrib/AspNet.Security.OAuth.Providers
• StackOverflow: https://stackoverflow.com/questions/tagged/aspnet-contrib

License

This project is licensed under the Apache License. This means that you can use, modify and distribute it freely. See https://www.apache.org/licenses/LICENSE-2.0.html for more details.

Migrating to OpenIddict

The OpenIddict client and its 75+ web providers have significant advantages over the simpler OAuth 2.0-only authentication handler that is used by the aspnet-contrib providers:

• OpenIddict fully supports OpenID Connect, which allows enforcing additional security checks for providers that implement it.

• The OpenIddict client is stateful and provides built-in countermeasures against nonce/token replay attacks.

• While the aspnet-contrib providers only support the OAuth 2.0 code flow, the OpenIddict providers support additional flows, including the OpenID Connect hybrid flow, the OAuth 2.0 client credentials grant, the resource owner password credentials grant or the refresh token grant.

• The OpenIddict client supports OAuth 2.0 token introspection and OAuth 2.0 token revocation.

• OpenIddict uses OAuth 2.0 and OpenID Connect server configuration discovery to avoid hardcoding the endpoint URIs of a provider when possible, making the OpenIddict web providers more robust and more future-proof.

• While the aspnet-contrib providers require targeting the latest ASP.NET Core version, the OpenIddict web providers can be used in any supported version. They can also be used in ASP.NET 4.6.1+ websites and Windows/Linux desktop applications.

• OpenIddict uses Microsoft.Extensions.Http.Polly (or Microsoft.Extensions.Http.Resilience on .NET 8+) to make backchannel HTTP communications less prone to transient network errors.

For more information on how to get started with the OpenIddict web providers, you can read:

• Getting started with the OpenIddict web providers
• Integrating with a remote server instance

To contribute a new OpenIddict provider, visit Contributing a new Web provider.

Providers

Links to the latest stable and nightly NuGet packages for each provider, as well as a link to their integration documentation are listed in the table below.

Documentation for the providers' settings can be found here.

If a provider you're looking for does not exist, consider making a PR to add one.

Provider	Stable	Nightly	Documentation
AdobeIO			Documentation
Alipay			Documentation
Amazon			Documentation
amoCRM			Documentation
Apple			Documentation
ArcGIS			Documentation
Asana			Documentation
Autodesk			Documentation
Baidu			Documentation
Basecamp			Documentation
BattleNet			Documentation
Bitbucket			Documentation
Buffer			Documentation
CiscoSpark (Webex Teams)			Documentation
Coinbase			Documentation
DeviantArt			Documentation
Deezer			Documentation
DigitalOcean			Documentation
Discord			Documentation
Dropbox			Documentation
eBay			Documentation
EVEOnline			Documentation
ExactOnline			Documentation
Feishu			Documentation
Fitbit			Documentation
Foursquare			Documentation
Gitee			Documentation
GitHub			Documentation
GitLab			Documentation
Harvest			Documentation
HealthGraph (Runkeeper)			N/A
Huawei			Documentation
HubSpot			Documentation
Imgur			Documentation
Instagram			Documentation
JumpCloud			Documentation
KakaoTalk			Documentation
Keycloak			Documentation
KOOK			Documentation
Kroger			Documentation
Lichess			Documentation
Line			Documentation
LinkedIn			Documentation
MailChimp			Documentation
MailRu			Documentation
Mixcloud			Documentation
Moodle			Documentation
Myob			Documentation
Naver			Documentation
NetEase			Documentation
Nextcloud			Documentation User EndPoint Documentation
Notion			Documentation
Odnoklassniki			Documentation
Okta			Documentation
Onshape			N/A
Patreon			Documentation
Paypal			Documentation
PingOne			Documentation
QQ			Documentation
QuickBooks			Documentation
Reddit			Documentation
Salesforce			Documentation
ServiceChannel			Documentation
Shopify			Documentation
Slack			Documentation
Smartsheet			Documentation
Snapchat			Documentation
SoundCloud			Documentation
Spotify			Documentation
Stack Exchange			Documentation
Strava			Documentation
Streamlabs			Documentation
SuperOffice			Documentation
Trakt			Documentation
Trovo			Documentation
Twitch			Documentation
Twitter			Documentation
Untappd			Documentation
Vimeo			Documentation
Visual Studio (Azure DevOps)			Documentation
Vkontakte			Documentation
Weibo			Documentation
Weixin (WeChat)			Documentation
WordPress			Documentation
WorkWeixin (WeCom)			Documentation
Xero			Documentation
Xumm			Documentation
Yahoo			Documentation
Yammer			Documentation
Yandex			Documentation
Zalo			Documentation
Zendesk			Documentation