Open.IdentityServer

• Added server-side session management (PR #94)
  Breaking: Renamed public entities and models from IdentityServerServerSideSessions to ServerSideSession
• Added support for Pushed Authorization Requests (PR #73)
  Breaking: Renamed IdentityServerPushedAuthorizationRequest to PushedAuthorizationRequest
  Breaking: Added a PAR method to the IOperationalStoreNotification interface.
• Improved prompt handling (PR #55)
  Breaking: Returns invalid_request for unsupported prompt modes rather than ignoring them.
  Added support for prompt=create.
  Fixes an IDS4 issue where max_age=0 causes an infinite login loop
• Added configurable max length restriction to resource indicators (PR #68) 
• Added integration points to extend model types (PR #75)
  Base stores have an overridable method to call entity/model mappers, allowing the types to be extended easily
• Added support for setting PollingInterval on individual clients using Device Flow (PR #76)
• Issue redirects by 303 code rather than 302 (PR #81)

• Fix UserCodeType not being mapped in Client model (PR #64)
• Fix ReferenceTokens not containing iat claim (PR #65)

Download on nuget.org or view the release on GitHub

• * Added Open Telemetry support. (e86376)
   Support is via the new ITelemetryService interface, constructor injected into most services through the codebase. If you have derived from framework classes, you must update your derived constructors to accept and pass through the new ITelemetryService parameter. 
  See the documentation for configuration guidance.

Download on nuget.org or view the release on GitHub

• Fix an additional null handling issue when using a Duende database and the keys table is empty. (fbabaf)
• Fix DistributedCacheAuthorizationParametersMessageStore.DeleteAsync improperly formatting cache keys. (c3aaf4)

Download on nuget.org or view the release on GitHub

• Fix Null Ref Exception when using CompatibilityKeyStore and the underlying storage is empty. (8cc0d4)
• dded MaxLifetime option for keys when using CompatibilityKeyStore. Default is 90 days. Previously it was possible for expired keys to be used if they were set to not be deleted after expiry in Duende IdentityServer. (ba038a)
• Fix audience claims not being mapped to token audiences in IdentityServerTools (90047b)

Download on nuget.org or view the release on GitHub

• Added support for Resource Indicators RFC 8707 (c613bd)
• Added persisted grant data protection (85703c)

• CVE-2024-39694, open redirect vulnerability fixed (6ccfbd)
• When creating token payload, ignore custom claims used for token validation (e.g. aud, iat, etc) (3ed930)
• Remove Nonce requirement when not asking for an ID tokens from the Auth Endpoint (375570)
• Update custom redirect result to make return url construction similar to that of login and consent (970529)
• Post logout in app auth validator using wrong uri list (678dd2)
• Custom Redirect return URL callback incorrect (cb7027)
• Fix GetAuthorizationContextAsync to return multiple query values from returnUrl (e62a27)
• Access tokens created by during refresh tokens flows do not generate new JTI claims (ef57c3)
• Added authorise response parameter 'iss' (cb3f87)
• Set refresh token usage to reuse by default (00f076)

Download on nuget.org or view the release on GitHub