Tutorials and security recipes from Sentinel, the embeddable identity, authentication and authorization platform for .NET.https://sentinel.nuvoralabs.com/https://sentinel.nuvoralabs.com/articles/first-login/https://sentinel.nuvoralabs.com/articles/first-login/Stand up a Sentinel host from nothing — EF stores, the engine, the authentication handler — and walk a real login, refresh and authenticated request through it.https://sentinel.nuvoralabs.com/articles/multi-org-and-delegated-admin/https://sentinel.nuvoralabs.com/articles/multi-org-and-delegated-admin/Model realm → organizations → teams, put one user in two orgs, switch org context without re-login, and hand each org an admin who structurally cannot touch the other — the fence lives in the evaluator, not the controller.https://sentinel.nuvoralabs.com/articles/oidc-server-in-your-app/https://sentinel.nuvoralabs.com/articles/oidc-server-in-your-app/Turn the host you already have into a standards-compliant OIDC provider — discovery, a confidential client, the code + PKCE flow with your own login UI, introspection and back-channel logout.https://sentinel.nuvoralabs.com/articles/passkeys/https://sentinel.nuvoralabs.com/articles/passkeys/Register a passkey, sign in without a password, and use a passkey as a second factor — the full WebAuthn ceremony flow with Sentinel's eligibility rules, sign-count defense and phishing-resistant session marking.https://sentinel.nuvoralabs.com/articles/permission-grammar-and-evaluation/https://sentinel.nuvoralabs.com/articles/permission-grammar-and-evaluation/Learn service:scope:action from the inside — patterns and wildcards, deny-overrides, org/team/self scoping, ABAC conditions, and the golden vectors that make the server and the browser agree.https://sentinel.nuvoralabs.com/articles/refresh-token-families/https://sentinel.nuvoralabs.com/articles/refresh-token-families/Why every refresh rotates, what a token family is, and how replaying a stolen token detonates the whole lineage — with the exact service, store contract and tests behind it.https://sentinel.nuvoralabs.com/articles/shadow-mode-migration/https://sentinel.nuvoralabs.com/articles/shadow-mode-migration/Import your users, run Sentinel's evaluator silently beside your legacy authorization, turn every disagreement into a reviewable event, and cut over only when the divergence counter reads zero.https://sentinel.nuvoralabs.com/articles/workload-identity-federation/https://sentinel.nuvoralabs.com/articles/workload-identity-federation/Delete the deploy secrets — configure a trust for GitHub Actions or Kubernetes OIDC tokens and exchange them for short-lived Sentinel access tokens, with wildcard subject matching and audited denials.https://sentinel.nuvoralabs.com/security/credential-stuffing/https://sentinel.nuvoralabs.com/security/credential-stuffing/Billions of breached email/password pairs, replayed against your login at low per-IP rates. How Sentinel's four windowed layers, distinct-identifier heuristic, adaptive CAPTCHA and risk engine raise the cost curve — and what happens when the counter store goes down.https://sentinel.nuvoralabs.com/security/saml-signature-wrapping/https://sentinel.nuvoralabs.com/security/saml-signature-wrapping/The XML-DSig attack class that broke a decade of SAML stacks — moving a validly-signed element and consuming an injected one — and the five-layer verification pipeline that makes Sentinel consume only what was signed.https://sentinel.nuvoralabs.com/security/session-fixation/https://sentinel.nuvoralabs.com/security/session-fixation/An attacker plants a session identifier before login and inherits the victim's authenticated session — and why Sentinel's post-authentication, server-minted session model leaves the attack nothing to fixate on.https://sentinel.nuvoralabs.com/security/token-theft-and-reuse-detection/https://sentinel.nuvoralabs.com/security/token-theft-and-reuse-detection/A stolen refresh token is a month of silent access — unless replaying it detonates the whole token family. How Sentinel's rotation and reuse detection turn theft into an alarm, and the runbook for the alarm.https://sentinel.nuvoralabs.com/security/user-enumeration/https://sentinel.nuvoralabs.com/security/user-enumeration/Login, reset and registration endpoints that answer "no such user" differently from "wrong password" hand attackers a verified target list. How Sentinel makes the two indistinguishable — by response, by timing, and by side effect.