ModgudMulti-tenant Identity Provider

Named after Móðguðr, the watcher of Gjallarbrú.

OAuth 2.0 / OpenID Connect server with multi-app permissions, granular RBAC, and full database-per-tenant isolation.

Drop-in for any ASP.NET Core resource server — and the auth foundation of the Cocoar suite.

Quickstart (Docker)

View on GitHub

Multi-tenant by design

Every realm gets its own PostgreSQL database via Marten's master-table tenancy. Domain-based routing maps Host headers to tenants — no tenant_id columns, no cross-realm leaks possible.

Multi-app permission model

Apps are first-class. Permissions are app-scoped (acme-tasks:todo:write), groups carry an activation list (BoundTo), roles bind to one app, and the resolver answers per-app permission queries in-memory.

Keycloak-style resource_access

Tokens carry resource_access keyed by app slug. A drop-in IClaimsTransformation library flattens the right block into ClaimTypes.Role so [Authorize(Roles="...")] works without per-endpoint plumbing.

Permissions on UserInfo

/connect/userinfo emits per-Audience resource_access blocks with bypass-pre-expansion and per-RS subset narrowing. Standard OIDC tooling consumes it; no custom client required.

Full 2FA spectrum + WebAuthn

TOTP, email-OTP, FIDO2/Passkey, magic-link. 2FA enforcement middleware with grace period and per-user override.

GDPR-ready

Self-service data export (Article 20), confirmable account deletion, Marten data-masking that scrubs PII from event streams while preserving audit-chain integrity.

About the name

Modgud takes its name from Móðguðr, the watcher of Gjallarbrú in Norse mythology — a bridge between worlds, where she challenged every traveler with the same question an IdP asks: "Who are you, and what brings you here?" A fitting namesake.