feat(security): authenticate Orleans connections

Directory.Packages.props

@@ -73,6 +73,8 @@
     <PackageVersion Include="Microsoft.Extensions.ObjectPool" Version="8.0.24" />
     <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.22.0" />
+    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.22.0" />
     <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.3.0" />
     <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="9.10.0" />
     <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" />

Orleans.slnx

@@ -70,6 +70,7 @@
     <Project Path="src/Orleans.Clustering.Consul/Orleans.Clustering.Consul.csproj" />
     <Project Path="src/Orleans.Clustering.ZooKeeper/Orleans.Clustering.ZooKeeper.csproj" />
     <Project Path="src/Orleans.Connections.Security/Orleans.Connections.Security.csproj" />
+    <Project Path="src/Orleans.Connections.Security.Entra/Orleans.Connections.Security.Entra.csproj" />
     <Project Path="src/Orleans.Hosting.Kubernetes/Orleans.Hosting.Kubernetes.csproj" />
   </Folder>
   <Folder Name="/src/Extensions/AdoNet/">
@@ -133,6 +134,7 @@
     <Project Path="test/Orleans.DependencyInjection.Tests/Orleans.DependencyInjection.Tests.csproj" />
     <Project Path="test/Orleans.Core.Tests/Orleans.Core.Tests.csproj" />
     <Project Path="test/Orleans.CodeGenerator.Tests/Orleans.CodeGenerator.Tests.csproj" />
+    <Project Path="test/Orleans.Connections.Security.Entra.Tests/Orleans.Connections.Security.Entra.Tests.csproj" />
     <Project Path="test/Orleans.Connections.Security.Tests/Orleans.Connections.Security.Tests.csproj" />
     <Project Path="test/Orleans.Journaling.Tests/Orleans.Journaling.Tests.csproj" />
     <Project Path="test/Orleans.Journaling.Json.Tests/Orleans.Journaling.Json.Tests.csproj" />

docs/Docs.slnx

@@ -69,6 +69,10 @@
     <Project Path="site/src/content/docs/host/snippets/aspire/SharedContracts/SharedContracts.csproj" />
     <Project Path="site/src/content/docs/host/snippets/aspire/Silo/Silo.csproj" />
   </Folder>
+  <Folder Name="/site/src/content/docs/host/snippets/authenticated-silo-connections/" />
+  <Folder Name="/site/src/content/docs/host/snippets/authenticated-silo-connections/csharp/">
+    <Project Path="site/src/content/docs/host/snippets/authenticated-silo-connections/csharp/AuthenticatedSiloConnections.Snippets.csproj" />
+  </Folder>
   <Folder Name="/site/src/content/docs/host/snippets/connection-middleware/">
     <Project Path="site/src/content/docs/host/snippets/connection-middleware/ConnectionMiddleware.csproj" />
   </Folder>

docs/site/src/content/docs/deployment/networking.md

@@ -84,7 +84,10 @@ Allow only the required paths:
 - Application ingress: the application's HTTP, gRPC, or other public protocol.
 - Provider endpoints: the identities and destinations required by each configured provider.
 
-Don't expose the silo port or gateway port to the public internet. If clients cross an untrusted network, use [Orleans TLS](../host/transport-layer-security.md) and enforce workload identity at the surrounding network boundary.
+Don't expose the silo port or gateway port to the public internet. Protect
+Orleans traffic with [TLS](../host/transport-layer-security.md), and use
+[authenticated Orleans connections](../host/authenticated-silo-connections.md)
+when silos or clients must prove workload identity at the transport boundary.
 
 ## Validate connectivity
 

docs/site/src/content/docs/deployment/production-readiness.md

@@ -1,7 +1,7 @@
 ---
 title: Production-readiness checklist
 description: Review an Orleans deployment before it receives production traffic.
-ms.date: 08/02/2026
+ms.date: 08/07/2026
 ms.topic: checklist
 ---
 
@@ -45,12 +45,17 @@ Complete this checklist for each production environment. Record owners, expected
 
 - [ ] The [Orleans trust boundaries](../security/index.md) and application-owned security controls are documented.
 - [ ] Only trusted workloads can reach silo and gateway ports.
-- [ ] Orleans transport security is configured when the network isn't already a trusted, isolated boundary. See [Orleans Transport Layer Security](../host/transport-layer-security.md).
+- [ ] TLS protects silo-to-silo and client-to-gateway traffic, with platform chain, DNS-name, EKU, and revocation validation. See [Secure Orleans connections with TLS](../host/transport-layer-security.md).
+- [ ] Workload authentication uses cluster-specific audiences, separate silo and client roles, explicit caller allowlists, and fail-closed enforcement. See [Authenticate Orleans connections](../host/authenticated-silo-connections.md).
+- [ ] Every silo and external Orleans client admitted by these policies is trusted to access the cluster; untrusted users are authenticated and authorized at application ingress.
 - [ ] Grain calls enforce [application authentication and authorization](../security/authentication-authorization.md), and validated credentials establish the identity carried through request context.
 - [ ] Serializer type-name resolution follows the [least-privilege type policy](../security/serialization.md).
+- [ ] Membership, storage, reminder, and stream providers independently use encrypted transport, workload identity, and least-privilege permissions.
+- [ ] Configured providers and persisted data are treated as trusted cluster infrastructure, with administrative access restricted accordingly.
 - [ ] Administrative endpoints, health details, metrics, and logs don't expose secrets or tenant data.
 - [ ] Provider identities have least privilege for membership, state, reminders, and streams.
 - [ ] Certificates and credentials have rotation and expiry alerts.
+- [ ] Negative connection tests prove that wrong certificates, tenants, audiences, roles, caller IDs, and baseline-only peers are rejected.
 
 ## Observability and operations