DuendeSoftware/foss imoc-7.1.1

Duende.IdentityModel.OidcClient 7.1.1

on GitHub

This patch release fixes pushed authorization requests (PAR) using a different client authentication method than the token endpoint.

• PAR now uses OidcClientOptions.TokenClientCredentialStyle, the same setting the token endpoint uses. Before this release, PAR sent the client secret in the Authorization header, while the token endpoint sent it in the request body, which is the default. Providers that require one authentication method per client, such as Authelia, rejected this, and the only workaround was to turn PAR off. If you use a client secret with the default settings, PAR now sends it in the request body. #351 (fixes #349)
• Update Microsoft.Extensions.Logging.Abstractions and System.Text.Json to 10.0.13, and raise the minimum System.IdentityModel.Tokens.Jwt version for Duende.IdentityModel.OidcClient.Extensions to 8.19.2. #376

This release still targets netstandard2.0, .NET 8, .NET 9 and .NET 10.