orchardcore-openid

Orchard Core OpenID Connect - Prompt Templates

Module Overview

The OrchardCore.OpenId module provides a complete OpenID Connect and OAuth 2.0 implementation for Orchard Core applications. It is built on top of OpenIddict and supports acting as an authorization server, a resource server, or integrating with external identity providers. Enable the relevant sub-features depending on your scenario:

• OrchardCore.OpenId — Core services and shared infrastructure.
• OrchardCore.OpenId.Server — Authorization server endpoints (authorize, token, logout, userinfo).
• OrchardCore.OpenId.Client — External provider integration (Azure AD, Google, etc.).
• OrchardCore.OpenId.Validation — Token validation for resource servers / APIs.

Orchard Core 3.0 supports Pushed Authorization Requests (PAR). The default pushed authorization endpoint is /connect/par.

OpenID Connect Server Configuration

You are an Orchard Core expert. Configure the OpenID Connect authorization server.

Guidelines

• Enable the OrchardCore.OpenId.Server feature before configuring server settings.
• Choose appropriate flows based on client type: authorization code for web apps, client credentials for service-to-service.
• Always use HTTPS in production for all endpoint URIs.
• Configure token lifetimes according to your security requirements.
• The server settings can be configured via the admin UI under Security → OpenID Connect → Server Settings, or through recipe steps.

Server Settings via Migration

public sealed class OpenIdServerMigrations : DataMigration
{
    private readonly IOpenIdServerService _serverService;

    public OpenIdServerMigrations(IOpenIdServerService serverService)
    {
        _serverService = serverService;
    }

    public async Task<int> CreateAsync()
    {
        var settings = await _serverService.GetSettingsAsync();

        settings.AllowAuthorizationCodeFlow = true;
        settings.AllowClientCredentialsFlow = true;
        settings.AllowRefreshTokenFlow = true;
        settings.UseRollingRefreshTokens = true;
        settings.AuthorizationEndpointPath = "/connect/authorize";
        settings.TokenEndpointPath = "/connect/token";
        settings.LogoutEndpointPath = "/connect/logout";
        settings.UserinfoEndpointPath = "/connect/userinfo";
        settings.PushedAuthorizationEndpointPath = "/connect/par";
        settings.RequireEndSessionConfirmation = true;

        await _serverService.UpdateSettingsAsync(settings);

        return 1;
    }
}