github DuendeSoftware/products is-7.3.0
IdentityServer 7.3.0
on GitHub

latest releases: is-7.4.0-alpha.1, templates-1.1.1, is-7.3.1...
22 days ago

IdentityServer 7.3.0 is a significant release that includes:

  • FAPI 2.0 profile certification
  • JWT Response from the introspection endpoint (RFC 9701)
  • Diagnostic data
  • Removal of the experimental label from OpenTelemetry metrics
  • Additional license compliance warnings
  • Several bug fixes
  • Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.3.0. Small code changes maybe be required for some users to upgrade.

  • The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class
  • Client Secret is now required for Clients with ClientCredentials Grant

The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class

  • Fix Concurrent DbContext Access on Back Channel Logout by @bhazen in #2019
    To fix a bug where when using EntityFramework, code which previously executed in parallel needed to be modified to execute sequentially. This necessitated the removal of the SendLogoutNotificationAsync method in the DefaultBackChannelLogoutService class. Anyone who had previously overridden the SendLogoutNotificationAsync as an extensibility point will likely need to move their customization to the PostLogoutJwt method.

Client Secret is now required for Clients with ClientCredentials Grant

  • Ensure Client Secret is Required for Clients with ClientCredentials Grant by @bhazen in #1796
    Previously, it was possible to configure a Client to allow the ClientCredentials Grant without requiring a client secret which is undesirable. The default validation of Clients has been updated to ensure any Client which allows the ClientCredentials grant also sets the RequireClientSecret flag to true to disallow the configuration of a private client to behave like a public client.

Enhancements

FAPI 2.0 Profile Certification

IdentityServer is 7.3.0 is officially certified as conformant with the FAPI 2.0 Security Profile.

JWT Response from Introspection Endpoint

IdentityServer now supports RFC 9701 to return a JWT Response from the Introspection endpoint.

  • Implement RFC 9701 to Return JWT Response from Introspection Endpoint by @bhazen in #1937

Diagnostic Data

Diagnostic data has been added to IdentityServer to help support with troubleshooting. Read more about this new feature in our docs. TODO: link to docs

Move OpenTelemetry Metrics from Experimental to Stable

  • Remove "Duende.IdentityServer.Experimental" service name from telemetry by @maartenba in #2002

Update License Usage Warnings

New warnings have been added around license compliance to help identify misuse of IdentityServer licenses prior to more strict license enforcement in the future.

Bug Fixes

  • Persistent Cookies, Server Side Sessions, and Session Lifetime Coordination Fix by @bhazen in #1757
  • Handle case-insensitive JSON claim value types. by @josephdecock in #1769
  • Ensure session lifetime coordination is invoked when a session expires by @bhazen in #1784
  • Ensure Client Secret is Required for Clients with ClientCredentials Grant by @bhazen in #1796
  • fix null ref in UserInfoRequestValidator by @SimonCropp in #1896
  • Don't unnecessarily return scope parameter from authorize endpoint by @bhazen in #1926
  • Addresses an unhandled exception path & nullability concerns by @StuFrankish in #1930
  • Don't return redirect URI or response mode on unsafe errors by @bhazen in #1933
  • Fix DCR customizations for EF client configuration by @josephdecock in #1962
  • Add and test unhandled exception logging filter logic by @khalidabuhakmeh in #2007
  • Fix Concurrent DbContext Access on Back Channel Logout by @bhazen #2019

Code Quality

Performance Enhancements

Developer Productivity

Check out latest releases or
releases around DuendeSoftware/products is-7.3.0

Don't miss a new products release

NewReleases is sending notifications on new releases.

Get notifications