DuendeSoftware/products is-7.4.0-preview.1

IdentityServer 7.4.0 - Preview 1

on GitHub

NOTE: There were minor issues with this release. There is a Preview 2 package available which should be used instead.

IdentityServer 7.4.0 is a significant release that includes:

• Support for .NET 10 (this preview targets .NET10 RC2)
• Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
• New Callback option for path detection in Dynamic Providers
• Improved UI locales support
• Support for custom parameters in the Authorize Redirect Uri
• Identity package now persists session claims based on an interface
• Skipping front-channel logout iframe when unnecessary
• Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

• Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
• Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

• Address CA1707 violations by @bhazen in #2128
  In the process of internal code cleanup, this unused and unreferenced file was used. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

• Address CA2211 Violations by @bhazen in #2170
  In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

• Set HTTP activity name on routing by @josephdecock in #2049
  • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
• Skip front-channel logout iframe when unnecessary by @bhazen in #2109
  • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
• Callback Option for Path Detection in Dynamic Providers by @bhazen in #2126
  • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
• Improved UI locales support by @bhazen in #2158
  • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
  • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
  • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
• RFC 8414 support by @bhazen in #2189
  • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
• Support for custom parameters in authorize response by @bhazen in #2206
  • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
• Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @bhazen in #2213
  • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
  • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
• .NET 10 Support (Simplified) by @josephdecock in #2216
  • Added initial support for .NET 10.

Bug Fixes

• Reject Pushed Authorization Requests with parameters duplicated in a JAR by @wcabus in #2073
  • Fixes a bug where when posting a PAR containing the "request" request parameter other requests parameters were being allowed.
  • Such as request will now correctly return an invalid request.
• Emit telemetry event on successful token introspection by @bhazen in #2231
  • Fixes a bug where the telemetry event for token introspection was not being emitted.
• Consolidated EF Core versions to prevent missing method exceptions by @bhazen in #2238
  • Fixes an issue where a mismatch of .NET versions and EF versions caused a method not found exception.
• Catch potential OperationCanceledException in DiagnosticHostedService by @wcabus in #2229
  • Fixes an issue where when the DiagnosticHostedService stops, the PeriodicTimer can throw an OperationCanceledException which was causing issues with some testing frameworks.

Code Quality

• Fixed typo in XML doc for Client.CoordinateLifetimeWithUserSession by @wcabus in #2078