Skip to content
Product capabilities

ProAuth Features

Modular, multi‑tenant identity with runtime configuration and deep integration hooks. Technical deep dives are available in the documentation.

Compare features and editionsView editions and pricing

The comparison matrix shows features by edition. Availability and behaviour also depend on your configuration.

Capability area 01

Identity & federation

Local accounts and corporate identities, configured for each tenant.

Open a capability for technical detail and documentation.
One integration, multiple identity sourcesApplications trust ProAuth as OpenID Provider. ProAuth is the client of the upstream OIDC provider and can use locally managed accounts.Your applicationsOIDC / OAuth clientsProAuthOpenID Provider / ASUpstream: RP / clientCorporate IdPUpstream OIDC providerProAuth user storeProAuth-managed accountsOIDC / OAuth 2.0OIDC federationLocal accounts
One integration, multiple identity sourcesApplications trust ProAuth as OpenID Provider. ProAuth is the client of the upstream OIDC provider and can use locally managed accounts.Your applicationsOIDC / OAuth clientsProAuthOpenID Provider / ASUpstream: RP / clientUser storeProAuth-managedLocal identitiesCorporate IdPUpstream OIDCExternal providerOIDC / OAuth 2.0Local accountsOIDC federation
One integration, multiple identity sourcesApplications trust ProAuth as OpenID Provider. ProAuth is the client of the upstream OIDC provider and can use locally managed accounts.Your applicationsOIDC / OAuth clientsProAuthOpenID Provider / ASUpstream: RP / clientProAuth user storeProAuth-managed accountsCorporate IdPUpstream OIDC providerOIDC / OAuth 2.0Local accountsOIDC federation

Accounts, federation and provisioning

Combine ProAuth accounts with enterprise sign-in and optional directory provisioning.

  • ProAuth user stores on SQL Server / Azure SQL or PostgreSQL, using the deployment’s configured database provider
  • Federate sign-in to customer OpenID Connect identity providers, including Entra ID
  • Enterprise: provision users and groups through SCIM. Provisioning synchronises directory data; federation delegates sign-in
  • Optional database deployment worker creates and configures user-store databases when enabled and configured

Tenants and runtime configuration

Configure identity sources and supported settings for each tenant within the same platform.

  • Tenant-specific identity providers, user stores and authentication settings
  • Manage tenants and supported settings at runtime through the admin application, APIs and configuration tooling
  • Tenant-specific login views and translations require Enterprise
Capability area 02

Clients, APIs & access

A standards-based integration, from the OIDC client to the protected API.

Open a capability for technical detail and documentation.
The BFF is the server-side token boundary The browser uses an HTTPS session with the BFF. Tokens and optional shared state stay server-side. The BFF is ProAuth’s OIDC/OAuth client and separately accesses the Resource API with an access token.SERVER-SIDE SECURITY BOUNDARYBFFOIDC / OAuth clientTokens stay here.BrowserClient-side applicationShared storageTickets / tokens / locks · optionalProAuthOpenID Provider /Authorization ServerResource APIProtected resourceHTTPS / sessionOIDC / OAuth 2.0OAuth access tokenServer-side state
The BFF is the server-side token boundary The browser uses an HTTPS session with the BFF. Tokens and optional shared state stay server-side. The BFF is ProAuth’s OIDC/OAuth client and separately accesses the Resource API with an access token.SERVER-SIDE SECURITY BOUNDARYBFFOIDC / OAuth clientTokens stay here.BrowserClient-side applicationShared storageTickets / tokens / locks · optionalProAuthOpenID Provider /Authorization ServerResource APIProtected resourceHTTPS / sessionOIDC / OAuth 2.0OAuth access tokenServer-side state
The BFF is the server-side token boundary The browser uses an HTTPS session with the BFF. Tokens and optional shared state stay server-side. The BFF is ProAuth’s OIDC/OAuth client and separately accesses the Resource API with an access token.SERVER-SIDE SECURITY BOUNDARYBFFOIDC / OAuth clientTokens stay here.BrowserClient-side applicationShared storageTickets / tokens / locks · optionalHTTPS / sessionServer-side state

The same BFF: identity and protected API access

The BFF is the server-side token boundary The browser uses an HTTPS session with the BFF. Tokens and optional shared state stay server-side. The BFF is ProAuth’s OIDC/OAuth client and separately accesses the Resource API with an access token.SERVER-SIDE SECURITY BOUNDARYBFFOIDC / OAuth clientTokens stay here.ProAuthOpenID Provider /Authorization ServerResource APIProtected resourceOIDC / OAuth 2.0OAuth access token
Architectural relationships, not a sequence diagram. Proof is used where required. Front-channel sign-in redirects are omitted.

Protocols and application flows

Connect applications and APIs through standard OIDC and OAuth flows.

  • Standards‑compliant OpenID Connect 1.0 and OAuth 2.0 for modern client and API architectures
  • Authorization Code with PKCE, Client Credentials, Device Authorization, and Token Exchange flows
  • Exact redirect matching and issuer validation; no password grant. Non-FAPI clients use rotating refresh tokens with replay protection.

BFF and .NET packages

Use maintained .NET building blocks for BFFs, clients and API token validation.

  • ProAuth BFF for ASP.NET Core: OAuth flows, API proxying and configurable server-side token and ticket storage
  • Redis or Dapr storage and locking integrations for multi-instance BFF deployments
  • OAuth/OIDC client packages for application-side token acquisition and sender-constrained requests
  • ASP.NET Core resource-server validation for bearer, DPoP and certificate-bound tokens, with configurable enforcement policies
  • Shared replay state for DPoP validation across API instances; applications retain responsibility for permissions and key management
Plan BFF and API adoption

Claims Rule Engine

Shape the claims your applications receive with the Enterprise Claims Rule Engine.

  • Enterprise: shape tokens per application by adding, transforming or removing claims with rules
Capability area 03

Users & provisioning

Manage identities and groups. Provision directory data independently of sign-in.

Open a capability for technical detail and documentation.
ProAuth identity provider SCIM options
SCIM options / EnterpriseProduct preview · example data

Attribute mappings are configured at the upstream provisioning provider. SCIM synchronises directory data; federation delegates sign-in.

Inspect accounts, federation and provisioning →
Capability area 04

Security & authentication

Passkeys for people. Token and request protection for compatible clients and APIs.

Open a capability for technical detail and documentation.
Real ProAuth Account Management passkey view
Register, name and remove passkeysProduct preview · example data

Passkeys and multifactor authentication

Choose passkey sign-in, additional factors and an authentication experience that fits your application.

  • Tenant-specific login views and branding with Enterprise
  • Passwordless User Store login with passkeys based on FIDO2/WebAuthn
  • Passkey MFA for User Store and federated users, plus TOTP; email with Business or Enterprise, SMS with Enterprise
  • Account Management for registering, naming and removing login passkeys; enabling passkeys does not delete existing password credentials
Plan passkey adoption

Token and request protection

Configure stronger token and request protection, with matching client and API integration.

  • FAPI 2.0 Security Profile as opt-in policy enforcement for high-value tenants and client applications
  • DPoP and mTLS bind tokens to a client key or certificate; clients and resource APIs must implement the corresponding proof validation
  • PAR and JAR harden authorization requests before the browser redirect
  • JWT introspection responses, reference tokens, token encryption, and revocation-friendly API validation
  • Pairwise subject identifiers and claims requests support privacy-focused relying-party integrations

Data protection and auditing

Protect sensitive data and use Enterprise audit trails to investigate identity events.

  • Encryption at rest for sensitive data and optional token encryption for access tokens, ID tokens, UserInfo responses, and introspection responses
  • Enterprise: signed, tamper-evident audit trails for administration changes and authentication events
  • Hardened containers with least‑privilege defaults
Capability area 05

Operations & deployment

The product and its dependencies on your infrastructure, with APIs and telemetry for your team.

Open a capability for technical detail and documentation.

YOUR OPERATING ENVIRONMENT

Runtime
ProAuth
  • Container image
  • Helm / Kubernetes
Persistence
Database
  • SQL Server · Azure SQL
  • PostgreSQL
Platform services
As configured
  • HTTPS certificates · keys
  • Shared services where required

One runtime, a supported database, and the services required by your configuration.

Deployment and lifecycle

Run on your Kubernetes infrastructure and plan scaling, upgrades and recovery.

  • Kubernetes‑ready containers with rolling upgrades and horizontal scaling
  • Plan upgrades and recovery around the deployment topology, release compatibility and database migrations

APIs and automation

Build configuration and administration into your own tools through APIs, CLI and YAML.

  • SDKs and REST APIs for deep integration
  • Automate with CLI and idempotent YAML; react to events via Dapr

Monitoring and diagnostics

Connect health checks and OpenTelemetry signals to your monitoring and alerting.

  • Health checks (liveness/readiness) for reliable orchestration
  • OpenTelemetry for logs, metrics, and traces
  • Custom spans and business metrics for deeper insights
  • Works with your existing monitoring and alerting stack
Adoption guides

Identity requirements also change within an existing application. Explore the path to stronger token protection or passkey sign-in.

Strengthen browser and API security

Use ProAuth BFF and .NET packages to introduce server-side token handling and sender-constrained API validation with clear integration steps.

Introduce passwordless sign-in

Plan passkey sign-in for ProAuth user stores, including supported devices, enrolment, domain continuity and account recovery.

Image detail