DuendeSoftware/products is-8.0.4

Duende IdentityServer 8.0.4

on GitHub

What's changed

This is a patch release of IdentityServer that adds support for IDP-initiated SSO when IdentityServer acts as a SAML Service Provider.

New features

• IDP-initiated SSO for SAML SP: When IdentityServer acts as a SAML Service Provider (via AddSamlServiceProvider() or dynamic SAML providers), it can now receive unsolicited authentication responses from upstream identity providers. Configure AllowUnsolicitedAuthnResponse = true and set IdpInitiatedCallbackUrl to your external login callback endpoint.
• RelayState surfacing: The SAML RelayState value from IDP-initiated responses is now available in AuthenticationProperties.Items["relayState"], allowing your callback to use it for routing, tenant resolution, or other application logic.
• Configurable RelayState size limit: MaxRelayStateLength (default 1024 bytes) controls the maximum size of RelayState that will be persisted in authentication properties, preventing cookie bloat from oversized values.
  Breaking changes
• SAML SP claim namespace changed: The internal claim type namespace used for SAML SP session correlation claims (SessionIndex, LogoutNameIdentifier) changed to https://duendesoftware.com/Saml2. Users with active SAML SP sessions at the time of upgrade may experience failed single logout correlation until they re-authenticate. This only affects deployments using the SAML Service Provider feature (AddSamlServiceProvider() or dynamic SAML providers).

Bug fixes

• Fixed misleading error messages in SAML SP unsolicited response handling.
• The SAML SP handler now correctly populates the scheme property in AuthenticationProperties during IDP-initiated sign-in, ensuring compatibility with IdentityServer's external login callback pattern.