Matt has spent the better part of a year circling a side project to build his own identity provider. Then, one afternoon this week, he realised he was solving the wrong problem, and that the solution he actually needed is one we all used to reach for without thinking.
This episode is the story of that realisation, and where it leads.
We start with a fast tour through how we got here — basic auth, forms and cookies, the shift to SPAs, OAuth 2, OIDC, JWTs and the well-known discovery document — and end up at the awkward corner .NET developers have been standing in since IdentityServer stopped being free: you own the whole app, you don’t want Entra, so what do you actually do?
That’s the jumping-off point for the bigger question: what else have we been conditioned to believe is too hard, too dangerous, or too high-risk — that we actually already know how to do?
We cover:
- A whistle-stop history of web auth and why cookies stopped being enough
- OAuth 2, OIDC, the discovery document, and the grants that actually matter (auth code + PKCE, client credentials, device code, and the much-maligned ROPC)
- Where the ASP.NET Core Identity API endpoints fit — and where they don’t
- The identity-vs-user distinction, and why your IDP shouldn’t be the source of truth for your app’s user data
- Matt’s specific MauiWorkshop.org problem and the year-long detour into building an IDP he didn’t need
- The “we just forgot” moment: doing social auth from the UI, not the backend
- Passwords in 2026 — why “forgot password” is the real login flow for most sites
- What “don’t roll your own auth” actually means, and where the industry has conflated the safe parts with the dangerous ones
🍻 Tonight’s Drinks
- Liam: Archie Rose whisky 🥃
- Matt: Going hard at the water
🔗 Tonight’s Links
- MauiWorkshop.org — Matt’s Razor Pages site that kicked off the whole thing
- AspNet.Security.OAuth.Providers — the community-maintained buffet of external auth providers for ASP.NET Core Identity
- ASP.NET Core Identity API endpoints (docs) — Microsoft’s current guidance for the single-app, own-your-own scenario
- OpenID Connect discovery document spec — the
.well-knownendpoint that ties it all together
Thumbnail attribution: Password 123456 written on a paper von Marco Verch unter Creative Commons 2.0
Any Likes 👍, Shares 📣, Subscriptions 🔔, and Love ❤️ go a long way to helping us keep the mics on.
Cheers! 🍻