# Duende Skills (ChatGPT Plugin)

> IdentityServer & OAuth skills

- Type: plugin
- Publisher: Duende Software (official)
- Categories: Development
- Website: https://chatgpt.com/plugins/plugins_6a86acf7816881918552f3b43bc0db69
- Open in ChatGPT: https://chatgpt.com/plugins/plugins_6a86acf7816881918552f3b43bc0db69
- Version: 0.3.0
- Listed: 2026-10-15

## About

Specialized skills and agents covering Duende IdentityServer configuration, OAuth 2.0 / OpenID Connect protocols, ASP.NET Core authentication and authorization, BFF patterns, token management, SAML, key management, deployment, and security hardening.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Duende Skills” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

## Skills

- **aspnetcore-authentication**: ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication, authentication schemes, challenge/forbid flows, and external identity provider integration.
- **aspnetcore-authorization**: ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations, scope-based authorization for APIs, authorization middleware configuration, and minimal API authorization.
- **claims-authorization**: Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation, claim type mapping, token claim filtering, extension grant validators, and dynamic claims loading.
- **duende-bff**: Duende BFF (Backend for Frontend) security framework for securing SPAs. Covers session management, API endpoint proxying, token management, anti-forgery protection, and integration with React/Angular/Blazor frontends.
- **identity-security-hardening**: Security hardening for Duende IdentityServer deployments including signing key rotation, HTTPS enforcement, CORS configuration, CSP headers, rate limiting, token lifetime tuning, and security audit patterns.
- **identity-testing-patterns**: Testing patterns for IdentityServer-based systems including integration testing with WebApplicationFactory, mock token issuance, test authority configuration, protocol response validation, and end-to-end authentication flow testing.
- **identityserver-api-protection**: Protecting APIs with Duende IdentityServer: JWT bearer authentication, reference token introspection, scope-based authorization, DPoP/mTLS proof-of-possession validation, local API authentication, and multi-audience scenarios.
- **identityserver-aspire**: Orchestrate Duende IdentityServer in .NET Aspire AppHost — dependency graphs, authority URL wiring, health checks, and multi-instance.
- **identityserver-configuration**: Configure Duende IdentityServer including client definitions, API resources, identity resources, scopes, signing credentials, and server-side sessions. Covers client types (M2M, interactive, SPA), grant types, API Scopes vs API Resources vs Identity Resources, secret management, and client authentication methods. Includes both in-memory and database-backed configuration.
- **identityserver-dcr**: Configuring Dynamic Client Registration (DCR) in Duende IdentityServer: endpoint setup, authorization policies, custom validation with DynamicClientRegistrationValidator, software statement validation, IClientConfigurationStore, and separate DCR hosting.
- **identityserver-deployment**: Guide for deploying Duende IdentityServer to production, covering reverse proxy configuration, data protection, health checks, distributed caching, multi-instance deployment, OpenTelemetry integration, logging, and common deployment pitfalls.
- **identityserver-hosting-setup**: Setting up and hosting Duende IdentityServer in ASP.NET Core applications, including DI registration, middleware pipeline, hosting patterns, essential options, license configuration, and ASP.NET Identity integration.
- **identityserver-key-management**: Managing cryptographic signing keys in Duende IdentityServer, including automatic key management, KeyManagementOptions, data protection at rest, static key configuration, migration from static to automatic, and multi-instance deployment considerations.
- **identityserver-saml**: Configuring Duende IdentityServer as a SAML 2.0 Identity Provider (IdP): service provider registration, SSO and SLO flows, claim mappings, extensibility interfaces, and production deployment patterns.
- **identityserver-sessions-providers**: Guide for configuring server-side sessions, session management and querying, inactivity timeout, dynamic identity providers, and CIBA (Client Initiated Backchannel Authentication) in Duende IdentityServer.

## Example prompts

- "My IdentityServer is deployed behind an nginx reverse proxy. How do I fix the wrong URL schema used?"
- "Configure the IdentityServerOptions for my project. Also configure data protection for a multi-instance deployment."
- "Give me a complete checklist of everything I need to do to upgrade from IdentityServer v7.4 to the latest."

## Related

- [Superpowers](https://chatgptplugins.directory/plugins/superpowers.md): Plan, develop, and debug code
- [Codex Security](https://chatgptplugins.directory/plugins/codex-security.md): Security scanning for your codebase
- [Build Web Apps](https://chatgptplugins.directory/plugins/build-web-apps.md): Build frontend-focused web apps with generated assets, browser testing, payments, and...
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Figma](https://chatgptplugins.directory/plugins/figma.md): Figma design-to-code workflows
- [Shopify](https://chatgptplugins.directory/plugins/shopify.md): Build and manage your store

---
Source: https://chatgptplugins.directory/plugins/duende-skills · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.