When enterprise apps need to support multiple identity providers (GitHub, ADFS, etc.), wiring each provider directly into every application creates duplication and tight coupling. The passthrough pattern with OpenIddict solves this by placing an OpenIddict authorization server in the middle: it registers external providers, uses EnableAuthorizationEndpointPassthrough() to intercept the authorization flow, delegates authentication to the appropriate external provider, transforms the resulting claims into a unified internal identity, and issues its own tokens. Client apps and internal APIs only ever interact with the OpenIddict server — they never know which external provider authenticated the user. The post walks through all three components: the OpenIddict server setup, the authorization controller with claims transformation and destination routing, the client app configuration using OpenIddict.Client, and the internal API validation using OpenIddict.Validation.
