Skip to content

Comments

Bump Duende.IdentityServer and Duende.IdentityServer.Storage#572

Closed
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/nuget/src/Services/Identity/Identity.API/multi-b72d2df73f
Closed

Bump Duende.IdentityServer and Duende.IdentityServer.Storage#572
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/nuget/src/Services/Identity/Identity.API/multi-b72d2df73f

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Dec 8, 2025

Updated Duende.IdentityServer from 7.0.8 to 7.4.2.

Release notes

Sourced from Duende.IdentityServer's releases.

7.4.2

This is a patch release that fixes a bug in license verification.

What's Changed

7.4.1

This is a patch release that fixes a bug related to CSP hashes.

What's Changed

7.4.0

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Since the 7.4.0 release candidate, there have been a few minor changes, including:

  • Add service for diagnostic data by @​josephdecock in #​2252
  • Trigger Back Channel Logout Earlier in Pipeline by @​bhazen in #​2258
  • Enable Customizing ErrorMessage on Redirect to Error Page by @​bhazen in #​2263
  • Better DCR Support for Public Clientsby @​bhazen in #​2264
  • Update .NET 10 from Release Candidate to GA by @​pgermishuys in #​2267

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    ... (truncated)

7.4.0-rc.1

This is the first release candidate of IdentityServer 7.4.0. The changes since the last preview release are:

  • Add service for diagnostic data by @​josephdecock in #​2252
  • Trigger Back Channel Logout Earlier in Pipeline by @​bhazen in #​2258
  • Enable Customizing ErrorMessage on Redirect to Error Page by @​bhazen in #​2263
  • Better DCR Support for Public Clientsby @​bhazen in #​2264
  • Update .NET 10 from Release Candidate to GA by @​pgermishuys in #​2267

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10 (this preview targets .NET10 RC2)
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    ... (truncated)

7.4.0-preview.2

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10 (this preview targets .NET10 RC2)
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    • Added initial support for .NET 10.
  • Updated IS and BFF to IM 8.0.0 Preview 1 and ATM Previews in #​2247

Bug Fixes

  • Reject Pushed Authorization Requests with parameters duplicated in a JAR by @​wcabus in #​2073
    • Fixes a bug where when posting a PAR containing the "request" request parameter other requests parameters were being allowed.
    • Such as request will now correctly return an invalid request.
      ... (truncated)

7.4.0-preview.1

NOTE: There were minor issues with this release. There is a Preview 2 package available which should be used instead.

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10 (this preview targets .NET10 RC2)
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was used. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    • Added initial support for .NET 10.

Bug Fixes

  • Reject Pushed Authorization Requests with parameters duplicated in a JAR by @​wcabus in #​2073
    • Fixes a bug where when posting a PAR containing the "request" request parameter other requests parameters were being allowed.
      ... (truncated)

7.3.2

This is a patch release that optimizes key creation when not using X509 Certificates.

Details

  • Do not unnecessarily request current issuer when creating new key

7.3.1

This is a patch release that fixes a bug and enables a System.Text.Json serialization option.

Details

  • Fixed an issue where uncommon license features caused an exception.
  • Allow RespectNullableAnnotationsDefault to be globally enabled. This is a relatively new feature in System.Text.Json that can be globally opted in to.

7.3.0

IdentityServer 7.3.0 is a significant release that includes:

  • FAPI 2.0 profile certification
  • JWT Response from the introspection endpoint (RFC 9701)
  • Diagnostic data
  • Removal of the experimental label from OpenTelemetry metrics
  • Additional license compliance warnings
  • Several bug fixes
  • Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.3.0. Small code changes maybe be required for some users to upgrade.

  • The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class
  • Client Secret is now required for Clients with ClientCredentials Grant

The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class

  • Fix Concurrent DbContext Access on Back Channel Logout by @​bhazen in Fix Concurrent DbContext Access on Back Channel Logout DuendeSoftware/products#2019
    To fix a bug where when using EntityFramework, code which previously executed in parallel needed to be modified to execute sequentially. This necessitated the removal of the SendLogoutNotificationAsync method in the DefaultBackChannelLogoutService class. Anyone who had previously overridden the SendLogoutNotificationAsync as an extensibility point will likely need to move their customization to the PostLogoutJwt method.

Client Secret is now required for Clients with ClientCredentials Grant

  • Ensure Client Secret is Required for Clients with ClientCredentials Grant by @​bhazen in Ensure Client Secret is Required for Clients with ClientCredentials Grant DuendeSoftware/products#1796
    Previously, it was possible to configure a Client to allow the ClientCredentials Grant without requiring a client secret which is undesirable. The default validation of Clients has been updated to ensure any Client which allows the ClientCredentials grant also sets the RequireClientSecret flag to true to disallow the configuration of a private client to behave like a public client.

Enhancements

FAPI 2.0 Profile Certification

IdentityServer is 7.3.0 is officially certified as conformant with the FAPI 2.0 Security Profile.

JWT Response from Introspection Endpoint

IdentityServer now supports RFC 9701 to return a JWT Response from the Introspection endpoint.

Diagnostic Data

Diagnostic data has been added to IdentityServer to help support with troubleshooting. Read more about this new feature in our docs. TODO: link to docs

7.3.0-rc.2

This is the second release candidate for IdentityServer 7.3.0, containing several bug fixes from 7.2 releases that were missed in the first release candidate, as well as editorial changes to some new log messages.

Detailed change log

Previously fixed bugs

Log messages

7.3.0-rc.1

This is release candidate 1 of IdentityServer 7.3.0, a significant release that includes:

  • FAPI 2.0 profile certification
  • JWT Response from the introspection endpoint (RFC 9701)
  • Diagnostic data
  • Removal of the experimental label from OpenTelemetry metrics
  • Additional license compliance warnings
  • Several bug fixes
  • Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.3.0. Small code changes maybe be required for some users to upgrade.

  • The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class
  • Client Secret is now required for Clients with ClientCredentials Grant

The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class

  • Fix Concurrent DbContext Access on Back Channel Logout by @​bhazen in Fix Concurrent DbContext Access on Back Channel Logout DuendeSoftware/products#2019
    To fix a bug where when using EntityFramework, code which previously executed in parallel needed to be modified to execute sequentially. This necessitated the removal of the SendLogoutNotificationAsync method in the DefaultBackChannelLogoutService class. Anyone who had previously overridden the SendLogoutNotificationAsync as an extensibility point will likely need to move their customization to the PostLogoutJwt method.

Client Secret is now required for Clients with ClientCredentials Grant

  • Ensure Client Secret is Required for Clients with ClientCredentials Grant by @​bhazen in Ensure Client Secret is Required for Clients with ClientCredentials Grant DuendeSoftware/products#1796
    Previously, it was possible to configure a Client to allow the ClientCredentials Grant without requiring a client secret which is undesirable. The default validation of Clients has been updated to ensure any Client which allows the ClientCredentials grant also sets the RequireClientSecret flag to true to disallow the configuration of a private client to behave like a public client.

Enhancements

FAPI 2.0 Profile Certification

IdentityServer is 7.3.0 is officially certified as conformant with the FAPI 2.0 Security Profile.

JWT Response from Introspection Endpoint

IdentityServer now supports RFC 9701 to return a JWT Response from the Introspection endpoint.

Diagnostic Data

Diagnostic data has been added to IdentityServer to help support with troubleshooting. Read more about this new feature in our docs. TODO: link to docs

7.2.4

This is a patch release that fixes a null reference exception that could occur if a client configuration is removed while active server side sessions exist that involve that client.

Detailed changelog

Full Changelog: DuendeSoftware/products@is-7.2.3...is-7.2.4

7.2.3

This is a patch release that fixes a regression where multiple WWW-authenticate headers where issued.

What's Changed

Full Changelog: DuendeSoftware/products@is-7.2.2...is-7.2.3

7.2.2

This is a patch release that

  • Hardens the default configuration of the sensitive values filters and
  • Fixes mTLS binding so that port numbers can be used as part of mTLS domain

Sensitive Values Filter Defaults

hardens the security of the default configuration that controls the redaction in logs of parameters passed to the Pushed Authorization (PAR) and Authorize endpoint, ensuring that client secrets and client assertions are not logged by default.

In particular, the default value of AuthorizeRequestSensitiveValuesFilter and PushedAuthorizationSensitiveValuesFilter have been changed to both be ["client_secret", "client_assertion", "id_token_hint"].

PAR requests sometimes are handled by the same code path as authorize requests, so this makes both filters the same by default.

mTLS port number

The MtlsOptions.DomainName can now include a port number.

Detailed Changelog

Full Changelog: DuendeSoftware/products@is-7.2.1...is-7.2.2

7.2.1

This is a patch release of IdentityServer that fixes a bug where a private_key_jwt client authentication token would be rejected if it had no typ header, even if strict validation of such tokens was not enabled.

What's Changed

7.2.0

IdentityServer 7.2 is a significant release that includes:

  • Optional strict validation of private_key_jwt audiences, implementing RFC 7523 bis
  • Optional caching of the discovery endpoint
  • Less log noise when issuing the use_dpop_nonce response from the token endpoint
  • Bug fixes and optimizations

Upgrading

There are no breaking changes or schema updates required to upgrade from IdentityServer 7.1 to 7.2.

Upgrading from IdentityServer 7.2.0-preview.1

We have moved the StrictClientAssertionAudienceValidation option that was introduced in 7.2.0-preview.1 into a new Preview section of the options. This new section provides a mechanism for us to deliver new features more quickly, and gives us the flexibility to change implementation details, behavior, or the API surface. Users can opt in to preview features at their own discretion, with the understanding that we make a stronger commitment to API stability once a feature leaves preview. Our intent with Preview flags is to be able to iterate quickly while still providing stability.

We've decided to mark StrictClientAssertionAudienceValidation as a preview option since the formal specification that it is based on (RFC 7523 bis) has not yet been adopted by the IETF OAuth working group.

RFC 7523 bis

RFC 7523 bis is a proposed update to RFC 7523 in which two new requirements for private_key_jwt client assertions are proposed:

  • That the audience (aud claim) must be the issuer of the authorization server and must be a single string
  • That the type (typ header) must be "client-authentication+jwt"

Similar strict audience validation requirements can be found in the FAPI 2.0 Profile.

The intent of the audience validation is to prevent certain academic attacks against OAuth ecosystems that include multiple Authorization Servers in which one of the Authorization Servers is compromised or malicious. The new type header value provides a mechanism to facilitate upgrades, because conforming clients that adopt the proposed changes will produce a token that can be easily distinguished by looking for the new type.

IdentityServer 7.2 includes preview support for RFC 7523 bis. Client applications can opt in to this support by setting the new type header; assertions that set the typ header to client-authentication+jwt always have their audience validated strictly. Other clients can continue to authenticate with private_key_jwts as they do today. IdentityServer can be configured to force clients to update by setting the option options.Preview.StrictClientAssertionAudienceValidation. When that flag is enabled, all private_key_jwt client assertions must set the typ to client-authentication+jwt, and must set their audience to the IdentityServer's issuer.

Discovery Document Caching

We've heard reports of cases where a high volume of requests to the discovery endpoint caused memory pressure and strain on server resources. This could happen in a solution with many clients calling the discovery endpoint, such as native (mobile) clients, SPA clients, or microservices that connect directly to the identity provider. It could also happen if misconfigured clients fail to cache the discovery response.

We’ve added a preview feature that allows you to cache the endpoint output using your distributed cache registration, with the default cache being an in-memory implementation. The cache is meant to reduce pressure when a sudden spike in requests occurs.

You must set the following property in your IdentityServerOptions instance to enable discovery document caching:

#pragma warning disable DUENDEPREVIEW001
pipeline.Options.Preview.EnableDiscoveryDocumentCache = true;
#pragma warning restore DUENDEPREVIEW001
pipeline.Options.Preview.DiscoveryDocumentCacheDuration = TimeSpan.FromMinutes(1);

It's best to keep the cache time low if you utilize the CustomEntries element on the discovery document or implement a custom IDiscoveryResponseGenerator.
This feature is a step in optimizing Duende IdentityServer to utilize server resources and improve performance. More benchmarking and tuning will follow.

use_dpop_nonce Log Noise Reduction

One way to configure DPoP is to require a server-issued nonce value. A nonce prevents replay or pre-generation of the proof tokens used in DPoP by having the authorization server provide a nonce value that the client must include in its signatures. That nonce is provided to the client through a protocol error response.

In IdentityServer 7.1 and earlier, this raised the TokenIssuedFailureEvent because, technically, the token endpoint returns an error. However, this interaction is an expected part of the interaction between client and server. It isn’t an error in the usual sense of the word, and it can happen quite often, resulting in lots of noise in the logs. Therefore, we no longer raise the TokenIssuedFailureEvent when returning a server-generated DPoP nonce.

For those still interested in knowing these errors are occurring, we have added additional Debug log messages to help diagnose and troubleshoot your client implementations. Because these messages are low severity, you must explicitly enable them in your environments to see them. The existing OTel metrics that track token error responses are unchanged, as they don’t add noise to the logs.

Detailed changelog

... (truncated)

7.2.0-preview.1

This is the first preview of IdentityServer 7.2. Highlights include:

  • Optional strict validation of private_key_jwt audiences
  • Error events are no longer raised for the use_dpop_nonce response from the token endpoint
  • Bug fixes and optimizations

Upgrading

There are no breaking changes or schema updates required to upgrade from IdentityServer 7.1 to 7.2.

What's Changed

New Contributors

Full Changelog: DuendeSoftware/products@is-7.1.0...is-7.2.0-preview.1

7.1.1

This is a patch release that fixes a bug that could cause sessions to expire instead of sliding.

What's Changed

7.1.0

IdentityServer 7.1.0 is a significant release that includes:

  • .NET 9 support
  • Use of Duende.IdentityModel
  • New license usage helpers
  • Friendly READMEs in the NuGet packages
  • Improved log filtering when HTTP requests are aborted
  • Redaction of the subject token during token exchange
  • Improved extensibility of the ClientConfigurationStore in the Configuration API
  • Several bug fixes
  • Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.1.0. Small code changes will be required for must users to upgrade.

  • IdentityModel renamed Duende.IdentityModel
  • ClientConfigurationStore now uses IConfigurationDbContext

IdentityModel renamed Duende.IdentityModel

  • Use Duende.IdentityModel 7.0.0 by @​damianh in Use Duende.IdentityModel 7.0.0 DuendeSoftware/products#1621
    Our open source IdentityModel library has been renamed Duende.IdentityModel, and we now depend on Duende.IdentityModel instead of IdentityModel. Duende.IdentityModel is a drop-in replacement for IdentityModel with updated namespaces that include the Duende prefix. If you are using IdentityModel's types in your IdentityServer implementation, you will need to update references from IdentityModel to Duende.IdentityModel (replace "using IdentityModel" with "using Duende.IdentityModel").

ClientConfigurationStore now uses IConfigurationDbContext

  • Use IConfigurationDbContext in ClientConfigurationStore by @​stefannikolei in Use IConfigurationDbContext in ClientConfigurationStore DuendeSoftware/products#1624
    The ClientConfigurationStore in the Duende.Configuration.EntityFramework package now depends on IConfigurationDbContext instead of ConfigurationDbContext to allow for customization. If you have a customized store that derives from the default store, you may need to update your constructors. Note that this only affects the Entity Framework based implementation of the configuration store used by the dynamic client registration configuration API.

Enhancements

.NET 9

License Usage Helpers

  • Add new license management services by @​josephdecock in Add new license management services DuendeSoftware/products#1637
    A LicenseUsageSummary is now available which includes the license edition and clients, issuers, and enterprise or business edition features used. The intent is to make it easier to understand which license is needed.

Other Enhancements

Bug Fixes

7.1.0-rc.2

This is release candidate 2 for IdentityServer 7.1.0. This adds a fix for DuendeSoftware/products#1689 to the previous release candidate. Please see 7.1.0-rc.1's release notes for further information about the 7.1.0 release.

7.1.0-rc.1

This is release candidate 1 for IdentityServer 7.1.0, a significant release that includes:

  • .NET 9 support
  • Use of Duende.IdentityModel
  • New license usage helpers
  • Friendly READMEs in the NuGet packages
  • Improved log filtering when HTTP requests are aborted
  • Redaction of the subject token during token exchange
  • Improved extensibility of the ClientConfigurationStore in the Configuration API
  • Several bug fixes
  • Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.1.0. Small code changes will be required for must users to upgrade.

  • IdentityModel renamed Duende.IdentityModel
  • ClientConfigurationStore now uses IConfigurationDbContext

IdentityModel renamed Duende.IdentityModel

  • Use Duende.IdentityModel 7.0.0 by @​damianh in Use Duende.IdentityModel 7.0.0 DuendeSoftware/products#1621
    Our open source IdentityModel library has been renamed Duende.IdentityModel, and we now depend on Duende.IdentityModel instead of IdentityModel. Duende.IdentityModel is a drop-in replacement for IdentityModel with updated namespaces that include the Duende prefix. If you are using IdentityModel's types in your IdentityServer implementation, you will need to update references from IdentityModel to Duende.IdentityModel (replace "using IdentityModel" with "using Duende.IdentityModel").

ClientConfigurationStore now uses IConfigurationDbContext

  • Use IConfigurationDbContext in ClientConfigurationStore by @​stefannikolei in Use IConfigurationDbContext in ClientConfigurationStore DuendeSoftware/products#1624
    The ClientConfigurationStore in the Duende.Configuration.EntityFramework package now depends on IConfigurationDbContext instead of ConfigurationDbContext to allow for customization. If you have a customized store that derives from the default store, you may need to update your constructors. Note that this only affects the Entity Framework based implementation of the configuration store used by the dynamic client registration configuration API.

Enhancements

.NET 9

License Usage Helpers

  • Add new license management services by @​josephdecock in Add new license management services DuendeSoftware/products#1637
    A LicenseUsageSummary is now available which includes the license edition and clients, issuers, and enterprise or business edition features used. The intent is to make it easier to understand which license is needed.

Other Enhancements

Bug Fixes

7.1.0-preview.1

IdentityServer 7.1.0-preview.1 is the first preview release of IdentityServer 7.1.0. It includes support for .NET 9, adds friendly READMEs to the NuGet packages, and includes a few smaller enhancements and bugfixes.

Breaking Changes

There are no breaking changes at the schema or API level in this release.

  • No schema updates are required.
  • While we are adding support for .NET 9, .NET 8 continues to be supported.

There is a log message change, which we highlight as a breaking change in case monitoring or other tooling that consumes the logs relies on the old behavior:

.NET 9

IdentityServer 7.1.0 supports both .NET 8 and .NET 9.

READMEs

Fixes and Enhancements

New Contributors

Full Changelog: DuendeSoftware/products@7.0.7...7.1.0-preview.1

Commits viewable in compare view.

Updated Duende.IdentityServer.Storage from 7.0.8 to 7.4.2.

Release notes

Sourced from Duende.IdentityServer.Storage's releases.

7.4.2

This is a patch release that fixes a bug in license verification.

What's Changed

7.4.1

This is a patch release that fixes a bug related to CSP hashes.

What's Changed

7.4.0

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Since the 7.4.0 release candidate, there have been a few minor changes, including:

  • Add service for diagnostic data by @​josephdecock in #​2252
  • Trigger Back Channel Logout Earlier in Pipeline by @​bhazen in #​2258
  • Enable Customizing ErrorMessage on Redirect to Error Page by @​bhazen in #​2263
  • Better DCR Support for Public Clientsby @​bhazen in #​2264
  • Update .NET 10 from Release Candidate to GA by @​pgermishuys in #​2267

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    ... (truncated)

7.4.0-rc.1

This is the first release candidate of IdentityServer 7.4.0. The changes since the last preview release are:

  • Add service for diagnostic data by @​josephdecock in #​2252
  • Trigger Back Channel Logout Earlier in Pipeline by @​bhazen in #​2258
  • Enable Customizing ErrorMessage on Redirect to Error Page by @​bhazen in #​2263
  • Better DCR Support for Public Clientsby @​bhazen in #​2264
  • Update .NET 10 from Release Candidate to GA by @​pgermishuys in #​2267

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10 (this preview targets .NET10 RC2)
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    ... (truncated)

7.4.0-preview.2

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10 (this preview targets .NET10 RC2)
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
  • Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
    • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
  • Improved UI locales support by @​bhazen in #​2158
    • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
    • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
    • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
  • RFC 8414 support by @​bhazen in #​2189
    • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
  • Support for custom parameters in authorize response by @​bhazen in #​2206
    • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
  • Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
    • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
    • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
  • .NET 10 Support (Simplified) by @​josephdecock in #​2216
    • Added initial support for .NET 10.
  • Updated IS and BFF to IM 8.0.0 Preview 1 and ATM Previews in #​2247

Bug Fixes

  • Reject Pushed Authorization Requests with parameters duplicated in a JAR by @​wcabus in #​2073
    • Fixes a bug where when posting a PAR containing the "request" request parameter other requests parameters were being allowed.
    • Such as request will now correctly return an invalid request.
      ... (truncated)

7.4.0-preview.1

NOTE: There were minor issues with this release. There is a Preview 2 package available which should be used instead.

IdentityServer 7.4.0 is a significant release that includes:

  • Support for .NET 10 (this preview targets .NET10 RC2)
  • Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
  • New Callback option for path detection in Dynamic Providers
  • Improved UI locales support
  • Support for custom parameters in the Authorize Redirect Uri
  • Identity package now persists session claims based on an interface
  • Skipping front-channel logout iframe when unnecessary
  • Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

  • Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
  • Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

  • Address CA1707 violations by @​bhazen in #​2128
    In the process of internal code cleanup, this unused and unreferenced file was used. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

  • Address CA2211 Violations by @​bhazen in #​2170
    In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

  • Set HTTP activity name on routing by @​josephdecock in #​2049
    • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
  • Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
    • Enables the UI to skip rendering the front channel logout iframe when it is not needed....

Description has been truncated

@dependabot
Bump Duende.IdentityServer and Duende.IdentityServer.Storage
9ee8d29 
Bumps Duende.IdentityServer from 7.0.8 to 7.4.2
Bumps Duende.IdentityServer.Storage from 7.0.8 to 7.4.2

---
updated-dependencies:
- dependency-name: Duende.IdentityServer
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Duende.IdentityServer.Storage
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Dec 8, 2025
@dependabot dependabot bot mentioned this pull request Dec 8, 2025
Closed
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Dec 8, 2025

Superseded by #573.

@dependabot dependabot bot closed this Dec 8, 2025
@dependabot dependabot bot deleted the dependabot/nuget/src/Services/Identity/Identity.API/multi-b72d2df73f branch December 8, 2025 06:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants