Bump Duende.IdentityServer from 7.2.3 to 7.4.2

[dependabot]

Updated Duende.IdentityServer from 7.2.3 to 7.4.2.

Release notes

Sourced from Duende.IdentityServer's releases.

7.4.2

This is a patch release that fixes a bug in license verification.

What's Changed

• fix IdentityServerLicenseValidator log formatting issue by @​Erwinvandervalk in fix IdentityServerLicenseValidator log formatting issue DuendeSoftware/products#2288

7.4.1

This is a patch release that fixes a bug related to CSP hashes.

What's Changed

• Fix incorrect CSP hash constants in check session endpoint by @​maartenba in Fix incorrect CSP hash constants in check session endpoint DuendeSoftware/products#2283

7.4.0

IdentityServer 7.4.0 is a significant release that includes:

• Support for .NET 10
• Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
• New Callback option for path detection in Dynamic Providers
• Improved UI locales support
• Support for custom parameters in the Authorize Redirect Uri
• Identity package now persists session claims based on an interface
• Skipping front-channel logout iframe when unnecessary
• Set HTTP activity name on routing

Since the 7.4.0 release candidate, there have been a few minor changes, including:

• Add service for diagnostic data by @​josephdecock in #​2252
• Trigger Back Channel Logout Earlier in Pipeline by @​bhazen in #​2258
• Enable Customizing ErrorMessage on Redirect to Error Page by @​bhazen in #​2263
• Better DCR Support for Public Clientsby @​bhazen in #​2264
• Update .NET 10 from Release Candidate to GA by @​pgermishuys in #​2267

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

• Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
• Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

• Address CA1707 violations by @​bhazen in #​2128
  In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

• Address CA2211 Violations by @​bhazen in #​2170
  In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

• Set HTTP activity name on routing by @​josephdecock in #​2049
  • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
• Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
  • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
• Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
  • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
• Improved UI locales support by @​bhazen in #​2158
  • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
  • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
  • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
• RFC 8414 support by @​bhazen in #​2189
  • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
• Support for custom parameters in authorize response by @​bhazen in #​2206
  • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
• Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
  • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
  • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
• .NET 10 Support (Simplified) by @​josephdecock in #​2216
  ... (truncated)

7.4.0-rc.1

This is the first release candidate of IdentityServer 7.4.0. The changes since the last preview release are:

• Add service for diagnostic data by @​josephdecock in #​2252
• Trigger Back Channel Logout Earlier in Pipeline by @​bhazen in #​2258
• Enable Customizing ErrorMessage on Redirect to Error Page by @​bhazen in #​2263
• Better DCR Support for Public Clientsby @​bhazen in #​2264
• Update .NET 10 from Release Candidate to GA by @​pgermishuys in #​2267

IdentityServer 7.4.0 is a significant release that includes:

• Support for .NET 10 (this preview targets .NET10 RC2)
• Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
• New Callback option for path detection in Dynamic Providers
• Improved UI locales support
• Support for custom parameters in the Authorize Redirect Uri
• Identity package now persists session claims based on an interface
• Skipping front-channel logout iframe when unnecessary
• Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

• Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
• Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

• Address CA1707 violations by @​bhazen in #​2128
  In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

• Address CA2211 Violations by @​bhazen in #​2170
  In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

• Set HTTP activity name on routing by @​josephdecock in #​2049
  • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
• Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
  • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
• Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
  • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
• Improved UI locales support by @​bhazen in #​2158
  • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
  • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
  • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
• RFC 8414 support by @​bhazen in #​2189
  • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
• Support for custom parameters in authorize response by @​bhazen in #​2206
  • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
• Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
  • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
  • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
• .NET 10 Support (Simplified) by @​josephdecock in #​2216
  ... (truncated)

7.4.0-preview.2

IdentityServer 7.4.0 is a significant release that includes:

• Support for .NET 10 (this preview targets .NET10 RC2)
• Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
• New Callback option for path detection in Dynamic Providers
• Improved UI locales support
• Support for custom parameters in the Authorize Redirect Uri
• Identity package now persists session claims based on an interface
• Skipping front-channel logout iframe when unnecessary
• Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

• Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
• Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

• Address CA1707 violations by @​bhazen in #​2128
  In the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

• Address CA2211 Violations by @​bhazen in #​2170
  In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

• Set HTTP activity name on routing by @​josephdecock in #​2049
  • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
• Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
  • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
• Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
  • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
• Improved UI locales support by @​bhazen in #​2158
  • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
  • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
  • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
• RFC 8414 support by @​bhazen in #​2189
  • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
• Support for custom parameters in authorize response by @​bhazen in #​2206
  • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
• Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
  • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
  • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
• .NET 10 Support (Simplified) by @​josephdecock in #​2216
  • Added initial support for .NET 10.
• Updated IS and BFF to IM 8.0.0 Preview 1 and ATM Previews in #​2247

Bug Fixes

• Reject Pushed Authorization Requests with parameters duplicated in a JAR by @​wcabus in #​2073
  • Fixes a bug where when posting a PAR containing the "request" request parameter other requests parameters were being allowed.
  • Such as request will now correctly return an invalid request.
    ... (truncated)

7.4.0-preview.1

NOTE: There were minor issues with this release. There is a Preview 2 package available which should be used instead.

IdentityServer 7.4.0 is a significant release that includes:

• Support for .NET 10 (this preview targets .NET10 RC2)
• Support for OAuth 2.0 Authorization Server Metadata (RFC 8414)
• New Callback option for path detection in Dynamic Providers
• Improved UI locales support
• Support for custom parameters in the Authorize Redirect Uri
• Identity package now persists session claims based on an interface
• Skipping front-channel logout iframe when unnecessary
• Set HTTP activity name on routing

Breaking Changes

There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.

• Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public
• Marked static properties referring to counters in Telemetry.cs as readonly

Removed the unused Duende.IdentityServer.Models.DiscoveryDocument class which was public

• Address CA1707 violations by @​bhazen in #​2128
  In the process of internal code cleanup, this unused and unreferenced file was used. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.

Marked static properties referring to counters in Telemetry.cs as readonly

• Address CA2211 Violations by @​bhazen in #​2170
  In the process of internal code cleanup, these properties were updated to be marked as readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.

Enhancements

• Set HTTP activity name on routing by @​josephdecock in #​2049
  • Set the DisplayName of the activity associated with the incoming HttpRequest when IdentityServer routes are matched. This makes the IdentityServer route names appear in OTel traces.
• Skip front-channel logout iframe when unnecessary by @​bhazen in #​2109
  • Enables the UI to skip rendering the front channel logout iframe when it is not needed.
• Callback Option for Path Detection in Dynamic Providers by @​bhazen in #​2126
  • Adds a new option for Dynamic Providers to increase flexibility when routing to dynamic providers. The new PathMatchingCallback setting can be used as an alternative to the previously existing PathPrefix option.
• Improved UI locales support by @​bhazen in #​2158
  • Improves support for the ui_locales parameter in protocol request which support it to allow for better localization.
  • The default implementation, DefaultUiLocalsService.cs, delegates to the CookieRequestCultureProvider if it is present and any of the values passed in the ui_locales parameter match a supported UI culture.
  • If the default implementation does not meet your needs, IUiLocalesService can be implemented and registered with DI.
• RFC 8414 support by @​bhazen in #​2189
  • Adds out of box support for OAuth 2.0 Authorization Server Metadata as defined in RFC 8414
• Support for custom parameters in authorize response by @​bhazen in #​2206
  • Adds a new CustomParameters property to AuthorizeResponse to support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a custom IAuthorizeResponseGenerator.
• Use Customizable Filter to Persist Session Claims in ASP.NET Identity by @​bhazen in #​2213
  • The ASP.NET Identity integration package now persists session claims based on ISessionClaimsFilter.FilterToSessionClaimsAsync which comes with a default implementation.
  • The new interface can be implemented to customize which session claims are persisted in non-default scenarios.
• .NET 10 Support (Simplified) by @​josephdecock in #​2216
  • Added initial support for .NET 10.

Bug Fixes

• Reject Pushed Authorization Requests with parameters duplicated in a JAR by @​wcabus in #​2073
  • Fixes a bug where when posting a PAR containing the "request" request parameter other requests parameters were being allowed.
    ... (truncated)

7.3.2

This is a patch release that optimizes key creation when not using X509 Certificates.

Details

• Do not unnecessarily request current issuer when creating new key

7.3.1

This is a patch release that fixes a bug and enables a System.Text.Json serialization option.

Details

• Fixed an issue where uncommon license features caused an exception.
• Allow RespectNullableAnnotationsDefault to be globally enabled. This is a relatively new feature in System.Text.Json that can be globally opted in to.

7.3.0

IdentityServer 7.3.0 is a significant release that includes:

• FAPI 2.0 profile certification
• JWT Response from the introspection endpoint (RFC 9701)
• Diagnostic data
• Removal of the experimental label from OpenTelemetry metrics
• Additional license compliance warnings
• Several bug fixes
• Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.3.0. Small code changes maybe be required for some users to upgrade.

• The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class
• Client Secret is now required for Clients with ClientCredentials Grant

The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class

• Fix Concurrent DbContext Access on Back Channel Logout by @​bhazen in Fix Concurrent DbContext Access on Back Channel Logout DuendeSoftware/products#2019
  To fix a bug where when using EntityFramework, code which previously executed in parallel needed to be modified to execute sequentially. This necessitated the removal of the SendLogoutNotificationAsync method in the DefaultBackChannelLogoutService class. Anyone who had previously overridden the SendLogoutNotificationAsync as an extensibility point will likely need to move their customization to the PostLogoutJwt method.

Client Secret is now required for Clients with ClientCredentials Grant

• Ensure Client Secret is Required for Clients with ClientCredentials Grant by @​bhazen in Ensure Client Secret is Required for Clients with ClientCredentials Grant DuendeSoftware/products#1796
  Previously, it was possible to configure a Client to allow the ClientCredentials Grant without requiring a client secret which is undesirable. The default validation of Clients has been updated to ensure any Client which allows the ClientCredentials grant also sets the RequireClientSecret flag to true to disallow the configuration of a private client to behave like a public client.

Enhancements

FAPI 2.0 Profile Certification

IdentityServer is 7.3.0 is officially certified as conformant with the FAPI 2.0 Security Profile.

• JWT Validation Clock Skew Option by @​bhazen in JWT Validation Clock Skew Option DuendeSoftware/products#1813
• Include PAR in mtls aliases by @​josephdecock in Include PAR in mtls aliases DuendeSoftware/products#1955
• Support binding of authorization codes to dpop proof key via dpop header by @​josephdecock in Support binding of authorization codes to dpop proof key via dpop header DuendeSoftware/products#1974
• Respect port number in mTLS configuration by @​josephdecock in Respect port number in mTLS configuration DuendeSoftware/products#1990
• Adjust Multiple DPoP Token Error by @​bhazen in Adjust Multiple DPoP Token Error DuendeSoftware/products#2004
• Options of Allowed Signing Algorithms JWTs and DPoP Proof Tokens by @​bhazen in Options of Allowed Signing Algorithms JWTs and DPoP Proof Tokens DuendeSoftware/products#2006
• Adjust Default Values for Clock Skew Config Options by @​bhazen in Adjust Default Values for Clock Skew Config Options DuendeSoftware/products#2010
• Change error when required DPoP proof is missing by @​bhazen in Change error when required DPoP proof is missing DuendeSoftware/products#2011
• Reworked supported algorithm options by @​josephdecock in Reworked supported algorithm options DuendeSoftware/products#2026
• Use standard error response for failed mTLS auth by @​josephdecock in Use standard error response for failed mTLS auth DuendeSoftware/products#2079
• mTLS with DPoP by @​josephdecock in mTLS with DPoP DuendeSoftware/products#2080
• Handle mTLS and DPoP Used Together by @​bhazen in Handle mTLS and DPoP Used Together DuendeSoftware/products#2084

JWT Response from Introspection Endpoint

IdentityServer now supports RFC 9701 to return a JWT Response from the Introspection endpoint.

• Implement RFC 9701 to Return JWT Response from Introspection Endpoint by @​bhazen in Implement RFC 9701 to Return JWT Response from Introspection Endpoint DuendeSoftware/products#1937

Diagnostic Data

Diagnostic data has been added to IdentityServer to help support with troubleshooting. Read more about this new feature in our docs. TODO: link to docs

• Diagnostic Summary Setup by @​bhazen in Diagnostic Summary Setup DuendeSoftware/products#2021
• Auth Scheme Diagnostic Entry by @​bhazen in Auth Scheme Diagnostic Entry DuendeSoftware/products#2022
• Registered Implementations Diagnostic Entry by @​bhazen in Registered Implementations Diagnostic Entry DuendeSoftware/products#2023
• IdentityServerOptions Diagnostic Entry by @​bhazen IdentityServerOptions Diagnostic Entry DuendeSoftware/products#2024
  ... (truncated)

7.3.0-rc.2

This is the second release candidate for IdentityServer 7.3.0, containing several bug fixes from 7.2 releases that were missed in the first release candidate, as well as editorial changes to some new log messages.

Detailed change log

Previously fixed bugs

• Add null-check for client before coordinating session lifecycle - Add null-check for client before coordinating session lifecycle DuendeSoftware/products#2038
• Ensure WWW-Authenticate uses a single HTTP header - Ensure WWW-Authenticate uses a single HTTP header  DuendeSoftware/products#1998
• Harden default logging filters for PAR and Authorize endpoints - Harden default logging filters for PAR and Authorize endpoints (7.2) DuendeSoftware/products#1978
• Respect port number in mTLS configuration - Respect port number in mTLS configuration DuendeSoftware/products#1990

Log messages

• Update licensing messages - Update licensing messages DuendeSoftware/products#2141

7.3.0-rc.1

This is release candidate 1 of IdentityServer 7.3.0, a significant release that includes:

• FAPI 2.0 profile certification
• JWT Response from the introspection endpoint (RFC 9701)
• Diagnostic data
• Removal of the experimental label from OpenTelemetry metrics
• Additional license compliance warnings
• Several bug fixes
• Numerous small code quality and performance enhancements from the community

Breaking Changes

There are no schema changes needed for IdentityServer 7.3.0. Small code changes maybe be required for some users to upgrade.

• The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class
• Client Secret is now required for Clients with ClientCredentials Grant

The SendLogoutNotificationAsync method has been removed from the DefaultBackChannelLogoutService class

• Fix Concurrent DbContext Access on Back Channel Logout by @​bhazen in Fix Concurrent DbContext Access on Back Channel Logout DuendeSoftware/products#2019
  To fix a bug where when using EntityFramework, code which previously executed in parallel needed to be modified to execute sequentially. This necessitated the removal of the SendLogoutNotificationAsync method in the DefaultBackChannelLogoutService class. Anyone who had previously overridden the SendLogoutNotificationAsync as an extensibility point will likely need to move their customization to the PostLogoutJwt method.

Client Secret is now required for Clients with ClientCredentials Grant

• Ensure Client Secret is Required for Clients with ClientCredentials Grant by @​bhazen in Ensure Client Secret is Required for Clients with ClientCredentials Grant DuendeSoftware/products#1796
  Previously, it was possible to configure a Client to allow the ClientCredentials Grant without requiring a client secret which is undesirable. The default validation of Clients has been updated to ensure any Client which allows the ClientCredentials grant also sets the RequireClientSecret flag to true to disallow the configuration of a private client to behave like a public client.

Enhancements

FAPI 2.0 Profile Certification

IdentityServer is 7.3.0 is officially certified as conformant with the FAPI 2.0 Security Profile.

• JWT Validation Clock Skew Option by @​bhazen in JWT Validation Clock Skew Option DuendeSoftware/products#1813
• Include PAR in mtls aliases by @​josephdecock in Include PAR in mtls aliases DuendeSoftware/products#1955
• Support binding of authorization codes to dpop proof key via dpop header by @​josephdecock in Support binding of authorization codes to dpop proof key via dpop header DuendeSoftware/products#1974
• Respect port number in mTLS configuration by @​josephdecock in Respect port number in mTLS configuration DuendeSoftware/products#1990
• Adjust Multiple DPoP Token Error by @​bhazen in Adjust Multiple DPoP Token Error DuendeSoftware/products#2004
• Options of Allowed Signing Algorithms JWTs and DPoP Proof Tokens by @​bhazen in Options of Allowed Signing Algorithms JWTs and DPoP Proof Tokens DuendeSoftware/products#2006
• Adjust Default Values for Clock Skew Config Options by @​bhazen in Adjust Default Values for Clock Skew Config Options DuendeSoftware/products#2010
• Change error when required DPoP proof is missing by @​bhazen in Change error when required DPoP proof is missing DuendeSoftware/products#2011
• Reworked supported algorithm options by @​josephdecock in Reworked supported algorithm options DuendeSoftware/products#2026
• Use standard error response for failed mTLS auth by @​josephdecock in Use standard error response for failed mTLS auth DuendeSoftware/products#2079
• mTLS with DPoP by @​josephdecock in mTLS with DPoP DuendeSoftware/products#2080
• Handle mTLS and DPoP Used Together by @​bhazen in Handle mTLS and DPoP Used Together DuendeSoftware/products#2084

JWT Response from Introspection Endpoint

IdentityServer now supports RFC 9701 to return a JWT Response from the Introspection endpoint.

• Implement RFC 9701 to Return JWT Response from Introspection Endpoint by @​bhazen in Implement RFC 9701 to Return JWT Response from Introspection Endpoint DuendeSoftware/products#1937

Diagnostic Data

Diagnostic data has been added to IdentityServer to help support with troubleshooting. Read more about this new feature in our docs. TODO: link to docs

• Diagnostic Summary Setup by @​bhazen in Diagnostic Summary Setup DuendeSoftware/products#2021
• Auth Scheme Diagnostic Entry by @​bhazen in Auth Scheme Diagnostic Entry DuendeSoftware/products#2022
• Registered Implementations Diagnostic Entry by @​bhazen in Registered Implementations Diagnostic Entry DuendeSoftware/products#2023
• IdentityServerOptions Diagnostic Entry by @​bhazen IdentityServerOptions Diagnostic Entry DuendeSoftware/products#2024
  ... (truncated)

7.2.4

This is a patch release that fixes a null reference exception that could occur if a client configuration is removed while active server side sessions exist that involve that client.

Detailed changelog

• Add null-check for client before coordinating session lifecycle by @​khalidabuhakmeh in Add null-check for client before coordinating session lifecycle DuendeSoftware/products#2038

Full Changelog: DuendeSoftware/products@is-7.2.3...is-7.2.4

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #10.