🚀 Abblix OIDC Server 2.x Released

Abblix OIDC Server 2.x is the biggest evolution of the library since its launch. A Result pattern migration across the entire codebase. A custom JWT engine replacing Microsoft's library. And even more.

Version 2 brings seven new RFCs including mutual TLS client authentication, support for input-constrained devices, backchannel authentication, Protobuf serialization, SSRF protection, ECDSA support, and compliance with 30+ OAuth 2.0, OpenID Connect, and JWT standards — all while maintaining our OpenID Foundation certification across all profiles.

📋 Full changelogs: v2.0 | v2.1 | v2.2

If you've been following Abblix OIDC Server or evaluating it for your .NET project, this post covers what shipped, why it matters, and what's coming next.

---

🛠 Breaking Changes

• .NET 6 and .NET 7 have been dropped as they reached end-of-life. Version 2.x targets .NET 8 (LTS), .NET 9 (STS), and .NET 10 (LTS).
• Result pattern migration (v2.0) replaced the inheritance-based response type hierarchy with Result<TSuccess, TFailure>. If you extended Abblix response types directly, see the v2.0 release notes for migration details.

---

🎉 What's New in 2.x

Custom JWT Implementation (v2.2) — We replaced Microsoft.IdentityModel.Tokens with a JWT engine built on .NET's native System.Text.Json.Nodes and cryptographic primitives. We are now free from three limitations: the Claim model that loses JSON type fidelity (numbers become strings, arrays get flattened, structured claims are serialized to opaque strings), the missing support for modern JWE algorithms (RSA-OAEP-256, AES-GCM key wrapping, direct key agreement), and the validation pipeline that throws exceptions on every failure — expensive in high-throughput scenarios. Our implementation is built from scratch on .NET's JsonObject to preserve JSON types natively, supports the full RFC 7518 algorithm suite (A128GCMKW/A192GCMKW/A256GCMKW, dir), and uses an exception-free Try pattern throughout validation.

mTLS Client Authentication — RFC 8705 (v2.0) — Mutual TLS with two methods: self_signed_tls_client_auth (JWKS public key matching) and tls_client_auth (Subject DN/SAN validation). Certificate-bound access tokens mean that even stolen tokens can't be used without the matching client certificate.

JWT Bearer Grant Type — RFC 7523 (v2.0) — Service-to-service authentication using signed JWTs. Critical for microservices architectures and API gateways where machine-to-machine communication happens without user interaction.

Device Authorization Grant — RFC 8628 (v2.0) — OAuth 2.0 flow for input-constrained devices: smart TVs, IoT devices, CLI tools, gaming consoles. Users authenticate on a secondary device while the primary device polls for authorization. Includes brute force protection with exponential backoff.

CIBA — Complete Delivery Modes (v2.0) — Client-Initiated Backchannel Authentication with ping notifications, push token delivery, and long-polling support. Enables authentication initiated by a consumption device (POS terminal, call center) with approval on the user's personal device.

ECDSA Support (v2.1) — ES256/ES384/ES512 signing algorithms per RFC 7518. Equivalent security with smaller keys (256-bit ECDSA matches 3072-bit RSA), resulting in faster operations and smaller tokens — important for mobile and IoT.

Dynamic Client Registration Management — RFC 7592 (v2.1) — Full client lifecycle management: create, read, update clients programmatically. Essential for SaaS platforms and multi-tenant deployments where client registration needs to be automated.

ACR/AMR Compliance — RFC 8176 (v2.2) — Authentication Context Class Reference values in the OpenID discovery document and aligned Authentication Method Reference values. Relying parties can now request specific authentication assurance levels.

---

⚙️ Architecture Changes

Result Pattern Migration (v2.0) — We replaced the inheritance-based response type hierarchy with Result<TSuccess, TFailure>, eliminating abstract base types and dozens of boilerplate response classes. Error handling is now enforced at compile time — less boilerplate, clearer intent, and no more runtime type-check surprises.

Protocol Buffer Serialization (v2.0) — Internal session and token storage now uses Protobuf serialization, achieving 40–60% smaller storage footprint with faster processing compared to JSON.

SSRF Protection (v2.0) — Multi-layered defense with DNS validation and IP blocking for all server-side HTTP requests, preventing Server-Side Request Forgery attacks.

---

📋 Platform Support

• .NET 8 (LTS) — supported until November 2026
• .NET 9 (STS) — current
• .NET 10 (LTS) — supported until November 2028

---

📖 Standards Coverage

Abblix OIDC Server now implements 30+ standards across three categories:

Full standards list

OAuth 2.0: RFC 6749, RFC 6750, RFC 7009, RFC 7636 (PKCE), RFC 7662, RFC 8628 (Device Auth), RFC 7591/7592 (Dynamic Registration), RFC 8705 (mTLS), RFC 8707, RFC 9068, RFC 9101 (JAR), RFC 9126 (PAR), RFC 9207

JSON Web Standards: RFC 7515 (JWS), RFC 7516 (JWE), RFC 7517 (JWK), RFC 7518 (JWA), RFC 7519 (JWT), RFC 7523, RFC 8176 (AMR)

OpenID Connect: Core 1.0, Discovery 1.0, Dynamic Registration 1.0, Session Management 1.0, RP-Initiated Logout 1.0, Front-Channel Logout 1.0, Back-Channel Logout 1.0, CIBA 1.0, PPID

Client Authentication Methods: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth, none

Full details: Implemented Standards

---

🚀 Getting Started

Install via NuGet:

dotnet add package Abblix.Oidc.Server.MVC

• Getting Started Guide
• Sample Project
• Full Documentation

---

🔮 What's Next

We're actively working on:

• DPoP — RFC 9449 — Proof-of-possession tokens that prevent theft and replay, even if TLS is compromised. Essential for FAPI 2.0 compliance. (Q2 2026)
• Token Exchange — RFC 8693 — Secure token exchange for delegation and impersonation in microservices architectures. (Q2 2026)
• Rich Authorization Requests — RFC 9396 — Fine-grained authorization beyond simple scope strings, enabling complex permission models for banking, healthcare, and enterprise. (Q2 2026)
• Minimal API Support — .NET Minimal APIs as an alternative to MVC controllers for OIDC endpoints. (Q3 2026)

See the full Product Roadmap.

---

💬 We'd Love Your Feedback

Whether you're already using Abblix OIDC Server or evaluating it for the first time:

• What standards or features would be most valuable for your use case?
• Are you migrating from another OIDC provider? What's driving the decision?
• Missing a standard or feature? Community input directly shapes what we build next.

Open an issue, start a Q&A discussion, or reach us at support@abblix.com.