identityserver-dcr

To secure Dynamic Client Registration, apply a policy-based authorization mechanism to the /connect/dcr endpoint. This protects client registration with enforced policies to prevent misconfigurations and unauthorized access.

Yes, you can customize client validation and defaults during OAuth DCR by customizing the DynamicClientRegistrationValidator. This allows you to enforce specific validation rules and apply pre-approved client metadata.

Software statements provide pre-approved client metadata for OpenID Connect Dynamic Client Registration. They allow clients to register themselves at a protected endpoint while ensuring the submitted metadata meets your authorization requirements.

Persist dynamically registered OAuth clients by wiring a persistent IClientConfigurationStore. This ensures that registered client configurations are safely stored and remain available across application restarts.

Yes, you can optionally separate the Dynamic Client Registration host from IdentityServer. This secure DCR hosting pattern allows you to isolate the registration endpoint while maintaining central configuration.

To enable Dynamic Client Registration in Duende IdentityServer, you must enable AddIdentityServerConfiguration, secure the /connect/dcr endpoint with an authorization policy, and wire a persistent IClientConfigurationStore.