ToamaisutaaWho gets through the gate.

トアマイスター - authentication for ASP.NET Core. OIDC bearer validation, optional local password login, and its own EF Core migrations.

Getting started

What is Toamaisutaa?

NuGet

Any OIDC provider

Every endpoint comes from the issuer's discovery document, so Keycloak, Authentik, Pocket ID, Okta and Entra are configuration rather than code.

Local login when you need it

Username and password sign-in for deployments that cannot run an identity provider, with rotating refresh tokens and lockout.

TOTP, without a TOTP library

Two-factor authentication with recovery codes, an opaque single-use challenge that cannot be presented as a bearer token, and secrets encrypted at rest. No new dependency.

Bring your own database

Postgres, SQLite, SQL Server and MySQL migrations ship with the package, or apply the entity configurations to a DbContext you already have.

Optional user table

Provisioning is opt-in. The package works perfectly well when the identity provider owns every user and you store nothing.