RVM.AuthForge

Overview

RVM.AuthForge is a complete Identity & Access Management (IAM) platform built with ASP.NET Core 10 and OpenIddict 7.4. It works as a centralized authorization server for the entire RVM Tech ecosystem, supporting OAuth2/OIDC flows (Authorization Code + PKCE, Client Credentials, Refresh Token), API Key authentication, two-factor authentication (2FA) with TOTP, comprehensive action auditing and an integrated Blazor Server admin dashboard.

Features

• Complete OAuth2/OIDC server with OpenIddict 7.4 (Authorization Code + PKCE, Client Credentials, Refresh Token)
• User management with registration, login, lockout after 5 attempts, password reset
• Two-factor authentication (2FA) with TOTP, QR Code and 10 recovery codes
• API Keys with SHA256 hash, validation and revocation
• Role-based access control (RBAC) with customizable roles
• Full audit trail with 16 action types, IP, User-Agent and Correlation ID
• Blazor Server admin dashboard with 7 interactive pages
• React SPA Portal support with pre-configured public OAuth2 client
• Rate limiting (10 req/min) on authentication endpoints

Technologies

• .NET 10
• ASP.NET Core Identity
• OpenIddict 7.4
• PostgreSQL
• EF Core 10
• Npgsql 10.0.1
• Blazor Server
• Serilog
• xUnit
• Moq

Patterns & architecture

• Layered Architecture (Domain/Infrastructure/API)
• Repository Pattern
• Policy-Based Authorization
• Custom Auth Handler Pattern
• Middleware Pipeline
• Configuration-Driven Seed Service

REST endpoints