Orion Documentation
Complete reference for the Orion Identity Platform
Platform Overview
Architecture, key concepts, data model, and authentication flows at a glance.
Configuration Reference
All environment variables with descriptions, defaults, and usage notes.
Authentication Schemes
Legacy Federation, OAuth 2.0 federated login, and HMAC API authentication.
OAuth 2.0 / OIDC
Endpoints, grant types, token lifetimes, scopes, consent, and client secrets.
Scopes & Claims
Scope namespaces, the Claims field, claim sources (meta:/expr:/ext:), and reserved names.
External Authentication
Signing in with Microsoft (Entra ID): provider configuration, home-realm discovery by email domain, and the token exchange.
External Claim Providers
Pulling claim values from your own systems: configuration, the endpoint contract, caching and failure modes.
Passkeys & FIDO2
WebAuthn via Fido2NetLib — relying-party configuration, registration and sign-in ceremonies, troubleshooting.
Application Management
Creating apps, system accounts, redirect URIs, permissions, and the directory.
Setup & Deployment
Fresh install, upgrades, schema migrations, and troubleshooting.
Security Features
FIDO2, TOTP, account lockout, PKCE, secret rotation, and token signing.
API Reference
Comprehensive endpoint listing for Legacy API, OAuth, and Management API.
SDK Integration
Installing the .NET SDK, filter types, OrionPrincipal, and code examples.
Sovereign Signing
Step-by-step guide to out-of-band JWT signing with external agents, key rotation, and trust modes.
Device Identity
Certificate-based device enrollment, per-org CA, TPM attestation, and device→Orion authentication.