Cerbos authorization for Duende IdentityServer
Duende IdentityServer provides OpenID Connect and OAuth 2.0 for your .NET applications. Cerbos consumes the identity tokens Duende issues and evaluates fine-grained authorization policies, so access control logic stays out of your ASP.NET middleware and API controllers.
Claims-driven policies
Map Duende IdentityServer claims, roles, and scopes directly to Cerbos principal attributes for fine-grained authorization
Beyond scopes
Move past OAuth 2.0 scope checks to policies that combine identity claims with resource ownership, time, and request context
Clean .NET integration
Keep authorization logic in Cerbos policies instead of scattering [Authorize] attributes and custom middleware across your ASP.NET codebase
How Cerbos works with Duende IdentityServer
Duende IdentityServer handles authentication, confirming who a user is. Cerbos handles authorization, deciding what that user can do. Together they give you a complete access control stack without coupling identity logic to business rules.
Cerbos lets you write fine-grained, context-aware authorization policies in human-readable YAML. Policies are decoupled from application code so product and security teams can update permissions without a release cycle.
Because Cerbos runs as a stateless Policy Decision Point (PDP) next to your application, authorization checks are sub-millisecond and scale horizontally with your infrastructure.
How Cerbos works with Duende IdentityServer
- Users authenticate via Duende IdentityServer, Duende handles login, consent, and token issuance using OpenID Connect. Custom profile services or claim transformations can enrich tokens with roles, department, or tenant information.
- Extract claims from the Duende-issued token, Your .NET application validates the JWT or reference token and extracts the user's subject, roles, scopes, and any custom claims.
- Send identity and resource context to Cerbos, Pass the user's claims as principal attributes alongside the target resource and desired action to the Cerbos PDP.
- Cerbos evaluates policies and returns a decision, Cerbos evaluates your YAML policies against the Duende identity data and resource attributes, returning allow or deny. Your application enforces the result.
FAQ
How does Cerbos use Duende IdentityServer tokens?
Duende IdentityServer issues OpenID Connect ID tokens and OAuth 2.0 access tokens containing claims such as roles, scopes, and custom profile data. Your application extracts these claims and passes them to Cerbos as principal attributes. Cerbos evaluates them against your policies alongside resource attributes and request context to produce an authorization decision.
Can I use Duende's client credentials flow with Cerbos?
Yes. For service-to-service communication, Duende IdentityServer issues client credentials tokens with scopes and custom claims. Cerbos treats the client identity the same as a user principal, so you can write policies that authorize machine-to-machine access based on client ID, granted scopes, or any custom claim in the token.
Does Cerbos replace Duende IdentityServer's built-in authorization?
No. Duende IdentityServer handles authentication, token issuance, and consent. Cerbos handles authorization. Duende's scope-based access control is coarse-grained by design. Cerbos adds resource-level and attribute-based policies on top without modifying your IdentityServer configuration.
Learn more about Cerbos
Related integrations
View all integrations →
Cerbos + Duende IdentityServer
- Cerbos extends Duende IdentityServer roles with fine-grained, attribute-based permissions
- Policies defined in human-readable YAML, managed as code
- Authorization logic decoupled from application code
- Sub-millisecond policy evaluation via stateless PDP