That was a mammoth ride. We set up a functional application for our small company, we secured access using IdentityServer 4, and we implemented permissions using roles.
I've said it a few times in this chapter, but just to conclude: when it comes to identity, and indeed security in general, there is no one right answer. IdentityServer makes sense in this case because we used an application and API owned and maintained by the company, we needed offline access, and we were supporting a desktop application. If you change just one of those parameters, it might make sense to use Google OAuth or Azure B2C.
To reiterate something else that I've also stated several times: security of any kind isn't an absolute. Your system might be very secure as it may use encrypted traffic and firewalls. However, you may have put your application through penetration testing and...
