--- title: Passthrough authentication with OpenIddict | daily.dev description: When enterprise apps need to support multiple identity providers (GitHub, ADFS, etc.), wiring each provider directly into every application creates duplication... canonical: https://daily.dev/posts/passthrough-authentication-with-openiddict-kbq4bh2kk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Passthrough authentication with OpenIddict | daily.dev og:description: When enterprise apps need to support multiple identity providers (GitHub, ADFS, etc.), wiring each provider directly into every application creates duplication... og:url: https://daily.dev/posts/passthrough-authentication-with-openiddict-kbq4bh2kk og:image: https://api.daily.dev/og/posts/kbQ4bH2KK.png og:image:alt: Passthrough authentication with OpenIddict og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Passthrough authentication with OpenIddict **[The Art of Simplicity](https://daily.dev/sources/bartwullems)** · 7 min read · 0 upvotes · 0 comments ## Summary When enterprise apps need to support multiple identity providers (GitHub, ADFS, etc.), wiring each provider directly into every application creates duplication and tight coupling. The passthrough pattern with OpenIddict solves this by placing an OpenIddict authorization server in the middle: it registers external providers, uses EnableAuthorizationEndpointPassthrough() to intercept the authorization flow, delegates authentication to the appropriate external provider, transforms the resulting claims into a unified internal identity, and issues its own tokens. Client apps and internal APIs only ever interact with the OpenIddict server — they never know which external provider authenticated the user. The post walks through all three components: the OpenIddict server setup, the authorization controller with claims transformation and destination routing, the client app configuration using OpenIddict.Client, and the internal API validation using OpenIddict.Validation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Spring Boot: Handling the OAuth2 Login Flow](https://daily.dev/posts/spring-boot-handling-the-oauth2-login-flow-emzofocay) · iO tech\_hub · 1 upvotes · 0 comments - [Passing custom parameters through OpenIddict's client authorization request](https://daily.dev/posts/passing-custom-parameters-through-openiddict-s-client-authorization-request-nj0fsgtoq) · The Art of Simplicity · 0 upvotes · 0 comments - [Configuring generic OIDC provider for authentication](https://daily.dev/posts/configuring-generic-oidc-provider-for-authentication-djrqahxia) · OctopusDeploy · 1 upvotes · 0 comments - [The man-in-the-middle pattern for MCP server OAuth](https://daily.dev/posts/the-man-in-the-middle-pattern-for-mcp-server-oauth-qdsmz4nun) · Tigris · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#aspnet](https://daily.dev/tags/aspnet) [View this post on daily.dev](https://daily.dev/posts/passthrough-authentication-with-openiddict-kbq4bh2kk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Passthrough authentication with OpenIddict","url":"https://daily.dev/posts/passthrough-authentication-with-openiddict-kbq4bh2kk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/passthrough-authentication-with-openiddict-kbq4bh2kk"},"datePublished":"2026-08-04T05:50:06.901Z","dateModified":"2026-08-04T05:50:30.742Z","description":"When enterprise apps need to support multiple identity providers (GitHub, ADFS, etc.), wiring each provider directly into every application creates duplication...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b006989a5bb3fe164e4da5ba3235d813?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b006989a5bb3fe164e4da5ba3235d813?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Art of Simplicity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Art of Simplicity","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/52b68c70636d44f0901ae7cd107c9438","url":"https://daily.dev/sources/bartwullems"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/passthrough-authentication-with-openiddict-kbq4bh2kk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,aspnet","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Art of Simplicity","item":"https://daily.dev/sources/bartwullems"},{"@type":"ListItem","position":3,"name":"Passthrough authentication with OpenIddict"}]} ```