Andy.Auth 2026.7.21-rc.250

Andy Auth Server

Self-hosted OAuth 2.0 / OpenID Connect server built with ASP.NET Core and OpenIddict.

ALPHA RELEASE WARNING

This software is in ALPHA stage. NO GUARANTEES are made about its functionality, stability, or safety.

CRITICAL WARNINGS:

• This tool performs DESTRUCTIVE OPERATIONS on files and directories
• Permission management is NOT FULLY TESTED and may have security vulnerabilities
• DO NOT USE in production environments
• DO NOT USE on systems with critical or irreplaceable data
• DO NOT USE on systems without complete, verified backups
• The authors assume NO RESPONSIBILITY for data loss, system damage, or security breaches

USE AT YOUR OWN RISK

Features

• OAuth 2.0 & OpenID Connect - Standards-compliant authentication server
• Multiple Grant Types - Authorization Code, Client Credentials, Refresh Tokens
• PKCE Support - Secure authentication for public clients
• MCP Compatible - Full Model Context Protocol OAuth 2.1 support for AI assistants
• Dynamic Client Registration - RFC 7591/7592 compliant DCR
• User Management - Complete admin UI for managing users and OAuth clients
• Audit Logging - Track all authentication and authorization events
• Security Hardened - Rate limiting, account lockout, security headers

Quick Start

Prerequisites

• .NET 8.0 SDK
• Docker Desktop (for PostgreSQL)
• IDE (VS Code, Visual Studio, or Rider)

Local Development

# 1. Start PostgreSQL
docker-compose up -d

# 2. Run the server
cd src/Andy.Auth.Server
dotnet run

Server runs at: https://localhost:5001

Test credentials:

• Email: test@andy.local
• Password: Test123!

See docs/LOCAL-SETUP.md for detailed setup instructions.

Andy.Auth Client Library

In addition to the OAuth server, this repository includes Andy.Auth, a NuGet library for easy integration with ASP.NET Core APIs.

Installation:

dotnet add package Andy.Auth

Usage:

// Add to Program.cs
builder.Services.AddAndyAuth(builder.Configuration);

See docs/LIBRARY.md for complete documentation.

What's Included

OAuth/OIDC Server

• Authorization endpoint (/connect/authorize)
• Token endpoint (/connect/token)
• Introspection endpoint (/connect/introspect)
• Revocation endpoint (/connect/revoke)
• Dynamic Client Registration (/connect/register)
• OpenID Discovery (/.well-known/openid-configuration)
• JWKS endpoint (/.well-known/jwks)

Admin Dashboard

• Users: View, suspend, expire, soft delete users
• OAuth Clients: Manage registered applications
• Tokens: View and revoke active tokens
• Audit Logs: Track all authentication events

Access at: /Admin

Seeded OAuth Clients

Security Features

• Rate limiting on all auth endpoints
• Account lockout (30 min after 5 failed attempts)
• Password requirements (8+ chars, uppercase, lowercase, digit)
• Security headers (CSP, X-Frame-Options, HSTS)
• CSRF protection on all forms
• SQL injection protection (EF Core)
• XSS protection (Razor auto-encoding)
• HTTPS enforcement in production

See docs/SECURITY.md for complete security documentation.

Technology Stack

• Framework: ASP.NET Core 8.0
• Authentication: ASP.NET Core Identity
• OAuth/OIDC: OpenIddict 5.x
• Database: PostgreSQL 16
• ORM: Entity Framework Core
• UI: Razor Views with custom CSS

Deployment

Railway

Deploy to Railway:

1. Push to GitHub
2. Connect Railway project
3. Configure environment variables
4. Deploy

See docs/DEPLOYMENT.md for complete deployment guide.

Docker

docker build -t andy-auth .
docker run -p 8080:8080 andy-auth

Examples

Working example applications for integrating with Andy Auth:

Run all examples tests:

./examples/test-examples.sh

Documentation

Interactive docs: Run the server and visit /docs/ for full documentation with tutorials.

Testing

Run all tests:

# .NET unit tests
dotnet test

# Python OAuth tests (against UAT)
cd tests/oauth-python
ANDY_AUTH_TEST_PASSWORD="Test123!" python3 run_all_tests.py --env uat

Current Status: See docs/testing.md for the latest test counts and pass rates.

See docs/testing.md for testing guide.

Contributing

Contributions are welcome! Please feel free to submit issues, feature requests, and pull requests.

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

License

Apache 2.0

Status: Alpha (UAT deployed for testing) Version: 0.1.0-alpha Last Updated: 2026-01-13