DuendeSoftware/products is-8.0.8

Duende IdentityServer 8.0.8

on GitHub

Duende IdentityServer 8.0.8

A patch release containing some SAML bug fixes and improvements. Also, based on customer feedback regarding logging in Identity Server, we have reduced the severity of select log messages.

• Validation failures from bad external input: Lowered from Error to Information for malformed requests (e.g., authorize and token endpoints), ensuring expected client-side errors no longer trigger error-level alerts.

Note: We are currently auditing all Identity Server log levels and will roll out further adjustments in upcoming releases.

Fixes and improvements

• SAML: Adds configurable outbound AuthnRequest signing when IdentityServer acts as a SAML service provider. Both static and dynamic provider configurations can select Never or Always, with safe defaults, certificate-presence validation, consistent metadata, and persisted dynamic-provider behavior.

• SAML logout sessions currently use the protected logout-message handle as their database lookup key. That protected value grows with serialized logout state and can exceed the nvarchar(200) column, causing SAML logout to fail with a truncation error.

• Fixed issue when calling both AddInMemoryClients and AddInMemorySamlProviders that the last call overwrites the first call.