MicroOAuthServer

A minimal OAuth 2.1 authorization server for .NET. The main usage is to to secure MCP (Model Context Protocol) servers with standards-compliant OAuth flows.

See MCP protocol specification for details about authorization requirements.

Features

• 🔐 OAuth 2.1 Compliant - PKCE-only flow (S256 method). Only Authorization Code and Refresh Token flows are supported.
• 📋 Additional Standards Support:
  • OAuth 2.0 Authorization Server Metadata (RFC8414)
  • OAuth 2.0 Dynamic Client Registration Protocol (RFC7591)
  • OAuth 2.0 Protected Resource Metadata (RFC9728)
  • [SOON] OAuth Client ID Metadata Documents (draft-ietf-oauth-client-id-metadata-document-00)

Quick Start

1. Install the NuGet package

Using .NET CLI

dotnet add package MicroOAuthServer --version 0.0.2

or using Package Manager

Install-Package MicroOAuthServer -Version 0.0.2

2. Registed dependencies in your ASP.NET project's Program.cs

using MicroOAuthServer;
using MicroOAuthServer.WebApp.Data;
using MicroOAuthServer.WebApp.Services;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

...

builder.Services.AddMicroOAuthServer(options =>
    {
        options.JwtSigningKey = "ThisIsTotallyNotMyJWTSecretPleaseDontHackMe!";
        options.Issuer = "https://localhost:7194";
    })
    .UseEntityFrameworkCore(options => 
    { 
      options.UseDbContext<ApplicationDbContext>(); 
    })
    .AddUserStore<DemoUserStore>()
    .WithDynamicClientRegistration()
    .WithAuthorizationServerMetadata()
    .WithResourceServerMetadata();
...

// Configure default for JWT authentication ommited

...

var app = builder.Build();

...

app.UseMicroOAuthServer()            // /oauth/authorize and /oauth/token
   .UseDynamicClientRegistration()   // /oauth/register
   .UseAuthorizationServerMetadata() // /.well-known/oauth-authorization-server
   .UseResourceServerMetadata();     // /.well-known/auth-protected-resource

...

app.Run();

3. Register tables in the DbContext

// Your DbContext
public class ApplicationDbContext(DbContextOptions<ApplicationDbContext> options) : DbContext
{
    // Your application entities (User, etc.)
    public DbSet<User> Users { get; set; }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        base.OnModelCreating(modelBuilder);

        // Configure MicroOAuthServer entities
        modelBuilder.ConfigureMicroOAuthServer();
    }
}

4. Implement reqired parts

Required (Implement Your Own):

• IUserStore - Authenticate users against your database
• Consent screen for you appp on /oauth/authorize. See examples.

Optional (Customize as Needed):

• IAuthorizationHandler
• ITokenHandler
• IClientStore, IAuthorizationCodeStore, IRefreshTokenStore

Register a custom implementation of the insterfaces after .AddMicroOAuthServer() call to replace built-in.

Example

1. Build and run

cd ./examples/MicroOAuthServer.WebAppWithMCP/
dotnet run

Or if you have .NET Aspire

cd ./examples/
aspire run

Aspire will automatically setup a Docker container with MS SQL database.

2. Test

Use MCP Inspecector to explore MCP tools in the example application. It has all OAuth-related functionality build-in, including support for dynamic client registration.