Implement SAML as an external provider in an ASP.NET Core Identity application using Duende as an OIDC server

This article shows how to implement a SAML federation from an ASP.NET Core Identity application using Sustainsys.Saml2.AspNetCore2. Entra ID is used to implement the SAML authentication and the use…

damienbod.com

.NET R&D Digest (June, 2026)

This issue includes bits of AI, software development, C++, C#, diagnostics, architecture and of course .NET and .NET Internals.

olegkarasik.wordpress.com

Avoiding ToString() allocations with StringBuilder.MoveChunks: Exploring the .NET 11 preview - Part 3

in this post I take a short look at the new MoveChunks API, explore how it works, what it's for, and how the new API provides opportunities for public APIs

andrewlock.net

Ich will euren KI-Dreck nicht mehr lesen

Was mir zuletzt auffällt und zunehmend auf den Keks geht: KI-generierte Texte, KI-generierte Plakate, KI-generierte Geburtstagskärtchen. Dabei meine ich nicht den ganzen Fake-SEO-Content oder die Scam...

thomasbandt.com

Stop AI Bots from Wasting Your Server's Time (and Your Money)

Block AI crawlers from wasting your server resources with a lightweight ASP.NET Core middleware that enforces robots.txt rules at the HTTP level.

duende.link

Enhance Security and Trust: New Session Metadata in Sign in with Google- Google Developers Blog

Boost app security with new Sign in with Google session metadata. Use OIDC claims like auth_time and amr to verify login freshness and authentication methods (MFA, hardware keys) for dynamic, risk-bas...

developers.googleblog.com

Software development and AI

This is a bit of rambling from me and what I believe is a good setup for developing software together with AI tools. I believe the AI tools are good, which will help good developers produce better …

damienbod.com

Setting Up SAML Single Sign-On in ASP.NET with Duende IdentityServer

SAML 2.0 is now in Duende IdentityServer! Easily integrate SAML-only SaaS apps like HubSpot and Salesforce into your existing SSO setup.

duende.link

ASP.NET Core background tasks with NCronJob and SignalR

I was recommended NCronJob for implementing a background worker in ASP.NET Core and so I decided to give it a try, read the docs and learn this. This NuGet package is open source and works great. I…

damienbod.com

.NET finally gets union types🎉: Exploring the .NET 11 preview - Part 2

In this post I discuss the support for union types released in .NET 11, how they're implemented, the choices made, and how to create your own

andrewlock.net

.NET R&D Digest (May, 2026)

This issue includes bits of AI (too much AI), C#, software development, architecture, Windows, security, NTFS and of course .NET and .NET Internals.

olegkarasik.wordpress.com

Aspire Azure SQL deployment bug

This week, I was updating my Aspire applications after the latest release and I ran into a deployment bug for my test deployments. I could no longer deploy the database to Azure SQL. I got the foll…

damienbod.com

GitHub - damienbod/bff-aspnetcore-angular: Backend for frontend security using Angular CLI and ASP.NET Core backend

Backend for frontend security using Angular CLI and ASP.NET Core backend - damienbod/bff-aspnetcore-angular

github.com

[HOWTO] Delete Azure DevOps users with principalName starting with OIDCONFLICT_UpnReuse_

In Azure DevOps organizations that are connected to Microsoft Entra, you may spot (duplicated) users with email prefixed with OIDCONFLICT_UpnReuse_{OID_HERE} (i.e. when trying to give them access or when mentioning them): Such users are neither visible in the Azure DevOps Web UI under Organization settings > General > Users nor when querying all users via graph or via the Azure DevOps CLI.

blog.rufer.be

Using configurable token lifetimes in Microsoft Entra ID, .NET and Microsoft Graph

Configurable token lifetimes in the Microsoft identity platform went GA and I thought I would look at implementing this using a .NET console application using Microsoft Graph . This article looks a…

damienbod.com

GitHub - damienbod/AspNetCoreCertificates: Certificate Manager in .NET Core for creating and using X509 certificates

Certificate Manager in .NET Core for creating and using X509 certificates - damienbod/AspNetCoreCertificates

github.com

Are Superpowers or GSD Better Than OpenSpec? - Improve & Repeat

improveandrepeat.com

Remove sign-up from Entra External ID user flows

This article shows how to remove the sign-up flow from Entra External ID user flows. This is required because SMS and Phone validation can be abused by bots to run up costs on the tenant. The bots …

damienbod.com

Containerize an ASP.NET Core BFF and Angular frontend using Aspire

Using Damien Bowden's secure ASP.NET Core and Angular BFF template as a starting point, this post shows how to integrate Aspire to improve local development and prepare the application for containeriz...

timdeschryver.dev

Configuring contextual options with Microsoft.Extensions.Options.Contextual

In this post I take a brief look at the Microsoft.Extensions.Options.Contextual package to understand what it's for, how to use it, and whether to use it or not

andrewlock.net

One of the most popular JavaScript packages on earth Axios has been compromised

The Axios NPM package has been compromised and the maintainer of the project has been locked out of their account. This will go down in history as one of the most successful software supply chain attacks ever

opensourcemalware.com

Invite Guest users in a Entra ID Multi-tenant setup

This post looks at implementing a guest user invite in a cross tenant setup. This is useful when creating partner tenants using an Entra ID MAU license for all partner guests and members. This make…

damienbod.com

GitHub - damienbod/bff-openiddict-aspnetcore-angular: OpenIddict backend for frontend security using Angular CLI and ASP.NET Core backend

OpenIddict backend for frontend security using Angular CLI and ASP.NET Core backend - damienbod/bff-openiddict-aspnetcore-angular

github.com

Recording metrics in-process using MeterListener: System.Diagnostics.Metrics APIs - Part 4

In this post I show how you can use MeterListener to listen to Instrument measurements, how to trigger Observable measurements, and how to aggregate values.

andrewlock.net

GitHub - damienbod/AspNetCoreOpenIddict: OpenIddict with Angular and Blazor WASM BFF OpenID Connect Code Flow with PKCE clients and ASP.NET Core APIs

OpenIddict with Angular and Blazor WASM BFF OpenID Connect Code Flow with PKCE clients and ASP.NET Core APIs - GitHub - damienbod/AspNetCoreOpenIddict: OpenIddict with Angular and Blazor WASM BFF ...

github.com

2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults

The number of DDoS attacks more than doubled in 2025. The network layer is under particular threat as hyper-volumetric attacks grew 700%.

blog.cloudflare.com

Add application security to the swiyu generic management verifier APIs using OAuth

The article looks at implementing security using OAuth for the swiyu Public Beta Trust Infrastructure generic containers. The container provides endpoint for OpenID verification and the management …

damienbod.com

Isolate the swiyu Public Beta management APIs using YARP

This post looks at hardening the security for the swiyu public beta infrastructure. The generic containers provide both management APIs and wallet APIs which support the OpenID for Verifiable Prese…

damienbod.com