I Brought IdentityServer Back to Life as Open Source (.NET 8)

The original IdentityServer project was commercialized. Instead of letting it die, I took the codebase, recompiled it for modern .NET, fixed what was broken, and released it as open source under the Apache 2.0 license.

This is not a wrapper — it's a working identity server that I rebuilt and verified end-to-end, with two sample applications proving that multi-app SSO and per-app permissions actually work.

What it does

• OAuth 2.0 + OpenID Connect with authorization code flow and PKCE
• SSO: one login for every app in your ecosystem
• JWT access tokens scoped per application (store.api, inventory.api, shared.scope)
• Independent roles & permissions per app, stored in MariaDB/MySQL
• Runs on .NET 8 at http://localhost:5000

The demo: two apps, different permissions

The repository ships with two MVC sample apps that log in through the identity server:

App	Client	Scope	Roles
🏬 Tienda	mvc.app1	store.api	Vendedor, Cajero
📦 Inventario	mvc.app2	inventory.api + shared.scope	Almacenista, Auditor

Here's the interesting part: the same user can have completely different roles in each app. Alice is a Vendedor in the store app and an Almacenista in the inventory app. Each application queries its own database (app1_tienda, app2_inventario) and enforces its own policies.

Github: https://github.com/rviquezsoft/IdentityServer8

Role-based authorization in practice

Each app registers permission policies and protects endpoints with [Authorize]:

csharp
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("Venta.Crear", p => p.AddRequirements(
        new PermissionRequirement("venta:crear")));
});