Duende Software, Inc.

Pushed Authorization Request (PAR) Support in ASP.NET Core We think that PAR is one of the easiest ways to increase the security of OAuth and OpenID Connect. That’s why we prioritized the implementation of the RFC and released fully featured support in IdentityServer v7. Unfortunately, it wasn’t as straightforward as it could be to add client-side PAR support to an existing ASP.NET Core application using the Microsoft OpenID Connect authentication handler. While the OIDC handler is general very well factored and provides extensibility points to accommodate a wide range of protocol extensions that haven’t even existed when the handler was written, for this particular scenario, it was lacking the right granularity. We have a sample here that adds PAR support, but unfortunately some of the OIDC handler internals had to be replicated. We are happy to announce that starting with .NET 9, the ASP.NET Core OIDC handler will have built-in PAR support. Even further, the current previews of .NET 9 have PAR enabled by default. This means every application gets the new security feature by default if the OIDC provider supports it. That’s huge. This feature was contributed by our IdentityServer lead Joe DeCock. Thanks Joe for making ASP.NET more secure!

Duende Software – The Next Chapter Almost exactly four years ago we announced the big news of transitioning our free, open-source project, IdentityServer, to a commercial, source-available product. As a part of that transition, we founded Duende Software as the new home for our products. Our main goal was to focus on IdentityServer – turning it into a sustainable product, improving the quality and reliability of our code base, and enhancing our samples, documentation and customer support. Along the way, we introduced a free tier of IdentityServer to support hobbyists, startups, and small businesses, and were able to grow our team to include multiple engineers, a web designer, and an office assistant. It was fun and exciting to see IdentityServer and the company grow, but we have been spending most of our time on, well, running a company. We realized we had less and less time to focus on the passions that drove us to start the IdentityServer project in the first place – technology, engineering, and protocols. It was also time to embark on a new journey to become a “real” company and grow beyond a “two person and a handful of contractors” startup. But we were lacking the skills around business, financials, marketing, and sales to achieve this efficiently. This is why we decided that the right decision would be to partner with professionals that are experienced in those areas. After more than 12 months of meeting potential candidates, we are happy to announce that we have partnered with Serent Capital to steer Duende Software into its next era of growth and transformation. Serent’s commitment to supporting our mission of providing great tools for developers aligns with our vision for the future, and we are eager to work together to expand on products and offerings to our community. This means that we can finally be engineers again and leave the “running the company” part to experts. Going forward, we will be able to focus exclusively on the technical direction, long-term product roadmap, new products (yes!), implementing standards, and help our customers to use our technology the best way. Oh, and by the way, we are hiring ([email protected])! Sincerely, Brock and Dominick