Skip to content
Product capabilities

ProAuth Features

Modular, multi‑tenant identity with runtime configuration and deep integration hooks. Technical deep dives are available in the documentation.

Compare features and editionsView editions and pricing

The comparison matrix shows features by edition. Availability and behaviour also depend on your configuration.

How the building blocks work together.

Your applications trust ProAuth. Behind that integration, combine local accounts and existing identity providers in one deployment.

Your applicationsInternal · partner · customer
OIDC / OAuth

Your ProAuth deployment

Sign-in · tenants · token issuance
ProAuth user storesSQL Server / Azure SQL or PostgreSQL
OIDC federation
Existing identity providersEntra ID · other OIDC providers
Architecture overview, not a request sequence. ProAuth acts as the identity provider for your applications and as an OIDC client of external providers. Applications and APIs remain responsible for token validation and application permissions.
Capability area 01

Connect your identities

A common integration for your applications, with configurable identity sources behind it.

Open a capability for technical detail and documentation.

Protocols and application flows

Connect applications and APIs through standard OIDC and OAuth flows.

  • Standards‑compliant OpenID Connect 1.0 and OAuth 2.0 for modern client and API architectures
  • Authorization Code with PKCE, Client Credentials, Device Authorization, and Token Exchange flows
  • Exact redirect matching and issuer validation; no password grant. Non-FAPI clients use rotating refresh tokens with replay protection.

Accounts, federation and provisioning

Combine ProAuth accounts with enterprise sign-in and optional directory provisioning.

  • ProAuth user stores on SQL Server / Azure SQL or PostgreSQL, using the deployment’s configured database provider
  • Federate sign-in to customer OpenID Connect identity providers, including Entra ID
  • Enterprise: provision users and groups through SCIM. Provisioning synchronises directory data; federation delegates sign-in
  • Optional database deployment worker creates and configures user-store databases when enabled and configured

Tenants and runtime configuration

Configure identity sources and supported settings for each tenant within the same platform.

  • Tenant-specific identity providers, user stores and authentication settings
  • Manage tenants and supported settings at runtime through the admin application, APIs and configuration tooling
  • Tenant-specific login views and translations require Enterprise
Capability area 02

Shape and protect access

Shape the sign-in experience and choose protection for users, clients and APIs.

Open a capability for technical detail and documentation.

Passkeys and multifactor authentication

Choose passkey sign-in, additional factors and an authentication experience that fits your application.

  • Tenant-specific login views and branding with Enterprise
  • Passwordless User Store login with passkeys based on FIDO2/WebAuthn
  • Passkey MFA for User Store and federated users, plus TOTP; email with Business or Enterprise, SMS with Enterprise
  • Account Management for registering, naming and removing login passkeys; enabling passkeys does not delete existing password credentials
Plan passkey adoption

Token and request protection

Configure stronger token and request protection, with matching client and API integration.

  • FAPI 2.0 Security Profile as opt-in policy enforcement for high-value tenants and client applications
  • DPoP and mTLS bind tokens to a client key or certificate; clients and resource APIs must implement the corresponding proof validation
  • PAR and JAR harden authorization requests before the browser redirect
  • JWT introspection responses, reference tokens, token encryption, and revocation-friendly API validation
  • Pairwise subject identifiers and claims requests support privacy-focused relying-party integrations

BFF and .NET packages

Use maintained .NET building blocks for BFFs, clients and API token validation.

  • ProAuth BFF for ASP.NET Core: OAuth flows, API proxying and configurable server-side token and ticket storage
  • Redis or Dapr storage and locking integrations for multi-instance BFF deployments
  • OAuth/OIDC client packages for application-side token acquisition and sender-constrained requests
  • ASP.NET Core resource-server validation for bearer, DPoP and certificate-bound tokens, with configurable enforcement policies
  • Shared replay state for DPoP validation across API instances; applications retain responsibility for permissions and key management
Plan BFF and API adoption

Claims Rule Engine

Shape the claims your applications receive with the Enterprise Claims Rule Engine.

  • Enterprise: shape tokens per application by adding, transforming or removing claims with rules
Capability area 03

Operate on your terms

Bring identity into your infrastructure, deployment tooling and operating processes.

Open a capability for technical detail and documentation.

Deployment and lifecycle

Run on your Kubernetes infrastructure and plan scaling, upgrades and recovery.

  • Kubernetes‑ready containers with rolling upgrades and horizontal scaling
  • Plan upgrades and recovery around the deployment topology, release compatibility and database migrations

APIs and automation

Build configuration and administration into your own tools through APIs, CLI and YAML.

  • SDKs and REST APIs for deep integration
  • Automate with CLI and idempotent YAML; react to events via Dapr

Data protection and auditing

Protect sensitive data and use Enterprise audit trails to investigate identity events.

  • Encryption at rest for sensitive data and optional token encryption for access tokens, ID tokens, UserInfo responses, and introspection responses
  • Enterprise: signed, tamper-evident audit trails for administration changes and authentication events
  • Hardened containers with least‑privilege defaults

Monitoring and diagnostics

Connect health checks and OpenTelemetry signals to your monitoring and alerting.

  • Health checks (liveness/readiness) for reliable orchestration
  • OpenTelemetry for logs, metrics, and traces
  • Custom spans and business metrics for deeper insights
  • Works with your existing monitoring and alerting stack
Adoption guides

Identity requirements also change within an existing application. Explore the path to stronger token protection or passkey sign-in.

Strengthen browser and API security

Use ProAuth BFF and .NET packages to introduce server-side token handling and sender-constrained API validation with clear integration steps.

Introduce passwordless sign-in

Plan passkey sign-in for ProAuth user stores, including supported devices, enrolment, domain continuity and account recovery.