I-01 Identity & Access
ASP.NET Core Identity or Azure AD B2C: choosing the front door
Own the password table or rent the login page. Both are fine choices; what is not fine is owning it by accident.
Drawn Oct 2012·Revised May 2025·7 min
Set I · 5 sheets
Identity & Access
Front doors, tokens, scoped roles and the machines that call your API at three in the morning.
I-02 Identity & Access
OpenID Connect for a multi-tenant web application: one issuer, many tenants
Every tenant wants to bring its own identity provider. The OIDC handler was designed for one. Here is how to make them agree without lying to the framework.
Drawn Apr 2016·Revised Nov 2025·7 min
I-03 Identity & Access
Authorization policies, requirements and handlers: roles that belong to a tenant
A role claim without a tenant next to it is a global role, and a global role in a multi-tenant product is a bug waiting for the second tenant.
Drawn Feb 2014·Revised Feb 2026·7 min
I-04 Identity & Access
API keys, client credentials and machine access
Customers integrate with a cron script long before they integrate with your SDK. Give the script a key, give the platform a token, and never store either in the clear.
Drawn Mar 2020·Revised Aug 2025·7 min
I-05 Identity & Access
Entra ID multi-tenant applications and the admin consent dance
One app registration, any customer directory. The consent flow is well documented. What to trust when the music stops is not.
Drawn Feb 2023·Revised May 2026·7 min