Spid/Cie Oidc - Relying Party .Net

SPID / CIE OIDC — .NET Relying Party for local testing

A SPID/CIE Relying Party developed in .NET without using any ready-made federation libraries.
The goal is to manually implement the OpenID Connect Federation 1.0 protocol in C#, following the AgID Italian profile, in order to understand every technical and cryptographic step in detail.

What it does

• Exposes a signed entity configuration at /.well-known/openid-federation, complete with metadata, authority_hints and trust marks.
• Resolves and validates the OpenID Provider's trust chain through the Trust Anchor.
• Builds the authorization request as a signed request object, following the JAR model, with PKCE S256.
• Authenticates to the token endpoint using private_key_jwt, with no static client registration: client registration happens automatically through the trust chain.
• Decrypts the UserInfo response in JWE format, using RSA-OAEP and A128CBC-HS256, and verifies the inner JWS.
• Handles refresh tokens with offline_access and RP-initiated logout with revocation.

Credits

Test infrastructure based on italia/spid-cie-oidc-django
https://github.com/italia/spid-cie-oidc-django
Apache-2.0 license.