Nuvora Nexus · .NET 10 · MIT licensed
Identity you can embed.
Authorization you can prove.
Sentinel is the batteries-included, code-first identity provider, authentication and authorization platform for .NET — the identity store and token authority for your apps, and a standards-compliant OIDC / SAML / SCIM server for everyone else's. Embed it as NuGet packages, or run it as a container. Both, if you like.
dotnet add package Nuvora.Nexus.Sentinel
The shape of a Sentinel host
Three moves. The platform does the rest.
Everything is a mountable minimal-API endpoint group and a TryAdd-idempotent DI extension. No hosted login pages, no separate server to babysit — unless you want the server, which ships too.
var builder = WebApplication.CreateBuilder(args);
// Stores first (first registration wins), then the engine, then HTTP.
builder.Services.AddSentinelEfCoreStores(o => o.UseNpgsql(connectionString));
builder.Services.AddSentinel();
builder.Services.AddSentinelAuthentication(o =>
{
o.Issuer = "https://id.example.com";
o.Audience = "example-api";
o.Transport = SentinelTokenTransport.BearerAndCookie;
});
var app = builder.Build();
app.UseAuthentication();
app.MapSentinelAuth(); // /auth/login · /auth/refresh · /auth/logout …
app.MapSentinelProfile(); // /profile/me · /profile/sessions …
app.MapSentinelPasskeys(); // WebAuthn registration + login ceremonies
app.Run();// Grants use the service:scope:action grammar — per-segment wildcards,
// org/team/self scoping, and explicit denies that win across the subject.
var subject = new SubjectSnapshot(
subjectId: userId, realmId: realm, organizationId: org,
teamMemberships: [teamA],
grants:
[
new Grant(PermissionPattern.Parse("records:org:read_*"), GrantEffect.Allow),
new Grant(PermissionPattern.Parse("records:org:read_billing"), GrantEffect.Deny),
]);
var check = new AccessCheck(PermissionId.Parse("records:org:read_chart"));
var decision = AuthorizationEvaluator.Evaluate(subject, check);
// decision.IsAllowed == true — and the browser can() agrees, because both
// implementations are pinned by the same golden vector suite.// The same host is a standards-compliant OAuth2/OIDC authorization
// server: code + PKCE, client credentials, refresh, introspection,
// revocation, back-channel logout.
builder.Services.AddSentinelOidcServer(o =>
{
o.Issuer = "https://id.example.com";
});
app.MapSentinelOidc();
// GET /.well-known/openid-configuration
// GET /oidc/jwks GET /oidc/authorize POST /oidc/token
// POST /oidc/introspect POST /oidc/revoke GET /oidc/logoutBatteries included
The security concerns are the platform.
Passkeys-first authentication
Password (argon2id), WebAuthn passkeys as first or second factor, TOTP, email OTP, recovery codes — with anti-enumeration and TOTP replay protection built in.
Authorization engine
RBAC + ABAC: the service:scope:action grammar, per-segment wildcards, deny-overrides, JSON condition AST — one evaluation path for checks and list visibility.
Tokens & sessions
RS256 JWTs verified via JWKS, opaque rotating refresh tokens with family-based reuse detection, device listing and remote logout.
OIDC provider
An in-house OAuth2/OIDC authorization server: code + PKCE, client credentials, refresh, discovery, introspection, revocation, back-channel logout.
Enterprise SSO
SAML 2.0 as both SP and IdP with a hardened XML-DSig pipeline, generic OIDC federation with JIT provisioning, SCIM 2.0 Users and Groups.
Multi-org tenancy
Realm → organizations → teams, users in many orgs, org context minted into the token, delegated admin fenced per-resource in the domain layer.
Machine identity
Service accounts with secret rotation, snt_ API keys capped by the owner’s live permissions, and workload federation for secretless CI/CD.
Webhooks & audit
HMAC-signed, retried webhook deliveries and a dual audit ledger — user-visible security events plus a tamper-evident admin hash chain.
Impersonation & break-glass
Time-boxed impersonation with an act claim and consent mode; break-glass with capped grants, alerting and a drill health check.
Risk & abuse protection
Four rate-limit layers plus deterministic risk signals — new device, impossible travel, velocity — mapped to allow / step-up / block.
Compliance & privacy
Per-user crypto-shredding, GDPR export and erasure endpoints, retention sweeps with hash-chain-aware redaction, six languages.
Migration & shadow mode
Importers for ASP.NET Identity, Keycloak, Auth0 and Duende; foreign hashes verify on day one; shadow-mode authorization gates cutover on zero divergence.
Standards, not folklore
Security recipes
Attacks, mapped to mechanisms.
Session fixation, token theft, SAML signature wrapping, user enumeration, credential stuffing — each recipe shows the attack, the exact Sentinel code and tests that counter it, and the part of the defense that stays yours.
Browse the recipes