Add standalone OpenID Connect authentication module with multi-provider abstractions#721

Merged

sfmskywalker merged 27 commits intoenh/auth-oidc-entrafrom

copilot/implement-elsastudio-authentication-oidc

Jan 9, 2026

Commits on Jan 8, 2026

Initial plan
Copilot
committed
Phase 1-3 complete: Core OIDC module with Server and WASM implementations

Copilot
and
sfmskywalker
committed
Add shared authentication abstractions for multi-provider support

Copilot
and
sfmskywalker
committed
Add comprehensive authentication architecture documentation

Copilot
and
sfmskywalker
committed
Final: Add implementation summary for PR review

Copilot
and
sfmskywalker
committed
Add authentication infrastructure and modules for Elsa Studio, including ElsaAuth and OpenID Connect integration.
sfmskywalker
committed
Update project references to include new Elsa Studio Authentication modules.
sfmskywalker
committed
Update `RedirectToLoginUnauthorizedComponentProvider` to support fallback to default Unauthorized component when `IAuthorizationService` is unavailable.
sfmskywalker
committed
Mark `Elsa.Studio.Login` APIs as obsolete and migrate authentication to `Elsa.Studio.Authentication.ElsaAuth`. Simplify dependencies and refactor JWT parsing for BlazorServer and BlazorWasm modules.
sfmskywalker
committed
Switch to OpenID Connect authentication, remove legacy login module, and update service registration methods.
sfmskywalker
committed
Replace `Login` module with OpenID Connect, update authentication pipeline, and revise default `GetClaimsFromUserInfoEndpoint`.
sfmskywalker
committed
Replace `BearerTokenHttpMessageHandler` with `AuthenticatingApiHttpMessageHandler` and remove obsolete references
sfmskywalker
committed
Organize solution structure by adding new folders: authentication, localization, workflows, deprecated, samples, and dashboard. Remove obsolete project references.
sfmskywalker
committed
Refactor authentication: replace legacy services, update OIDC implementation, and restructure PKCE flow
sfmskywalker
committed
Add `Elsa.Studio.Authentication.ElsaAuth.UI` module to provide Elsa Identity authentication with a login UI and unauthorized redirect behavior.
sfmskywalker
committed
Migrate `AUTHENTICATION_ARCHITECTURE.md` to `doc/` folder, update project references, and refine namespace imports for authentication module.
sfmskywalker
committed
Introduce `IAnonymousBackendApiClientProvider` and refactor API client creation to support non-authenticated backend calls.
sfmskywalker
committed
Add token refresh mechanism for OpenID Connect and Elsa Identity authentication modules. Introduce token refresh coordinators, configuration providers, and support for silent token refresh. Update …
sfmskywalker
committed
Add persisted token refresh for OpenID Connect in Blazor Server: implement browser-side pings, background services, and configurable strategies.
sfmskywalker
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add standalone OpenID Connect authentication module with multi-provider abstractions#721

Add standalone OpenID Connect authentication module with multi-provider abstractions#721
sfmskywalker merged 27 commits intoenh/auth-oidc-entrafrom
copilot/implement-elsastudio-authentication-oidc

Commits on Jan 8, 2026

Initial plan

Phase 1-3 complete: Core OIDC module with Server and WASM implementations

Add shared authentication abstractions for multi-provider support

Add comprehensive authentication architecture documentation

Final: Add implementation summary for PR review

Add authentication infrastructure and modules for Elsa Studio, including ElsaAuth and OpenID Connect integration.

Update project references to include new Elsa Studio Authentication modules.

Update `RedirectToLoginUnauthorizedComponentProvider` to support fallback to default Unauthorized component when `IAuthorizationService` is unavailable.

Mark `Elsa.Studio.Login` APIs as obsolete and migrate authentication to `Elsa.Studio.Authentication.ElsaAuth`. Simplify dependencies and refactor JWT parsing for BlazorServer and BlazorWasm modules.

Switch to OpenID Connect authentication, remove legacy login module, and update service registration methods.

Replace `Login` module with OpenID Connect, update authentication pipeline, and revise default `GetClaimsFromUserInfoEndpoint`.

Replace `BearerTokenHttpMessageHandler` with `AuthenticatingApiHttpMessageHandler` and remove obsolete references

Organize solution structure by adding new folders: authentication, localization, workflows, deprecated, samples, and dashboard. Remove obsolete project references.

Refactor authentication: replace legacy services, update OIDC implementation, and restructure PKCE flow

Add `Elsa.Studio.Authentication.ElsaAuth.UI` module to provide Elsa Identity authentication with a login UI and unauthorized redirect behavior.

Migrate `AUTHENTICATION_ARCHITECTURE.md` to `doc/` folder, update project references, and refine namespace imports for authentication module.

Introduce `IAnonymousBackendApiClientProvider` and refactor API client creation to support non-authenticated backend calls.

Add token refresh mechanism for OpenID Connect and Elsa Identity authentication modules. Introduce token refresh coordinators, configuration providers, and support for silent token refresh. Update …

Add persisted token refresh for OpenID Connect in Blazor Server: implement browser-side pings, background services, and configurable strategies.

Commits on Jan 9, 2026

Remove persisted token refresh strategy and related services from OpenID Connect configuration.

Refactor OIDC configuration for Blazor WebAssembly: add Azure AD compatibility patches, improve URI handling, and modularize features.

Fix Azure AD authentication in Blazor WASM by passing explicit API scopes during token exchange (#722)

Remove obsolete Azure AD compatibility patches and cleanup related JavaScript and Razor components.

Refactor OpenID Connect callback path handling: use null-coalescing assignments and remove default path values from `OidcOptions`.

Add token purposes and scoped token caching for enhanced authentication configuration

Add scoped access token capabilities and token-purpose configuration

Refactor authentication modules: simplify scoped token handling, update OIDC providers, and enhance incremental consent support.