authentication-authorization-patterns

Implement OAuth 2.0 and OpenID Connect authentication for .NET healthcare applications.

24|5|Updated Nov 28, 2025

Search Tags:#oauth #jwt #rbac #mfa #sso #abp #openid

Ready to run

npx skills add https://github.com/thapaliyabikendra/ai-artifacts --skill authentication-authorization-patterns

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: authentication-authorization-patterns
Source: https://github.com/thapaliyabikendra/ai-artifacts/tree/main/.claude/skills/authentication-authorization-patterns
Command: npx skills add https://github.com/thapaliyabikendra/ai-artifacts --skill authentication-authorization-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Master secure authentication and authorization patterns including OAuth 2.0, OpenID Connect, JWT tokens, refresh tokens, role-based access control (RBAC), claims-based authorization, MFA, and SSO for .NET applications using OpenIddict and ABP Framework.

Core Features & Use Cases

Authentication vs Authorization: Clear separation and implementation guidance.
OAuth 2.0/OpenID Connect: Flows, token handling, and client/server configurations.
JWT & Refresh Tokens: Secure token generation and renewal processes.
RBAC & Claims: Role-based access control and claims-based authorization.
MFA & SSO: Multi-factor authentication and single sign-on practices.
API Protection: Securing endpoints and permissions management.

Quick Start

Configure OpenIddict in the ABP host and set up a sample login flow using OAuth 2.0.

Frequently Asked Questions about authentication-authorization-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement OAuth 2.0 and OpenID Connect authentication in a .NET application?▼

OAuth 2.0 and OpenID Connect authentication in .NET involves configuring OpenIddict to handle token issuance, defining client and server roles, and selecting the appropriate flow—authorization code, client credentials, or resource owner password—based on your application architecture.

What's the difference between authentication and authorization, and how do I implement both?▼

Authentication verifies user identity through credentials or tokens; authorization grants access permissions based on roles and claims. Implement both by configuring identity verification with OAuth 2.0, then enforce role-based access control (RBAC) and claims-based policies on protected endpoints.

How do I secure JWT tokens and manage token refresh in .NET APIs?▼

Secure JWT tokens by generating them with OpenIddict, storing refresh tokens securely server-side, validating token signatures and expiration on each request, and implementing refresh token rotation to issue new access tokens without re-authenticating.

Can I implement multi-factor authentication and single sign-on with OpenIddict and ABP Framework?▼

Yes. ABP Framework and OpenIddict support MFA through additional verification steps during authentication and SSO by issuing tokens valid across multiple applications, allowing centralized identity management and session sharing.

What's the best way to enforce role-based and claims-based access control on API endpoints?▼

Define roles and claims during token issuance in OpenIddict, then apply authorization policies on .NET API endpoints using attributes or middleware to check user roles and claims before granting access to protected resources.

Does this approach work for healthcare applications with compliance requirements?▼

Yes. The Skill focuses explicitly on .NET healthcare applications, covering secure token handling, encrypted storage, claims management, and API endpoint protection—patterns designed to meet authentication and authorization compliance standards.