Platform Overview

What is Orion?

Orion is a federated identity platform and OAuth 2.0 / OpenID Connect provider designed to centralise user authentication and application authorization for organisations of any size.

It provides a single sign-on experience across all registered applications, with support for legacy cookie-based federation, standards-compliant OAuth 2.0 flows, and HMAC-signed API authentication for machine-to-machine communication.

Key Concepts

• Organisation — A tenant. Each organisation has its own applications, users, and OAuth configuration. Identified by a unique PublicId (GUID).
• Application — A service registered under an organisation. Its PublicId doubles as the OAuth client_id.
• User — A human identity belonging to an organisation. Users authenticate via email/password plus optional 2FA.
• System Account — A non-human identity linked to an application. Used for server-to-server communication with a public/secret key pair (HMAC).
• Key — Cryptographic material tied to a user or system account. Keys have types (session, public, secret) and optional expiry.

Architecture

Orion is built on the following technology stack:

• Runtime: ASP.NET Core 10 (cross-platform)
• Database: PostgreSQL via Entity Framework Core with code-first migrations
• Token Signing: RSA (RS256) with pluggable key providers (Environment Variable, Database with AES-256 KEK, Azure Key Vault)
• Client SDK: Clashawaun.Orion.Sdk.NetCore NuGet package
• WebAuthn: Fido2NetLib for passwordless authentication

The server exposes both MVC views (management UI, login pages, consent screens) and JSON API endpoints (legacy API, OAuth endpoints, management API).

Data Model

The core entity hierarchy follows this ownership chain:

Each Organisation owns one or more Applications. Applications have Users (via permission grants) and System Accounts (direct children). Both users and system accounts hold Keys that are used for authentication.

Additional entities include:

• ApplicationRequirement / Requirement — Permission policies that users must accept before accessing an application.
• ApplicationPermission — A record that a user accepted a specific policy version for an application.
• Authenticator — FIDO2 credentials or TOTP secrets linked to a user for second-factor authentication.
• OAuthClientSecret — Hashed client secrets with labels, expiry, and revocation status.
• OAuthConsent — Records of user or organisation-wide consent for OAuth scopes.
• OAuthDeviceCode / OAuthAuthorizationCode / OAuthRefreshToken — Token lifecycle entities.

Authentication Flows

The original Orion authentication method. The client application uses OrionFederationFilter to redirect unauthenticated users to /federation/Login. After login, Orion redirects back with a session key (orion_key) that the SDK exchanges for user data and sets as a cookie.

Standards-compliant OpenID Connect. The SDK redirects to /oauth/{org}/authorize, the user authenticates, an authorization code is issued, and the SDK exchanges it for JWT tokens (access token, ID token, optional refresh token). Supports PKCE by default.

For server-to-server communication. System accounts send an Authorization header containing the public key and an HMAC-SHA256 signature computed from the request body using the secret key. Validated by the OrgStandard authentication scheme.