Update dependency Duende.IdentityServer.EntityFramework.Storage to 6.3.10 - autoclosed #57
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
2a9447e to
2ea249c
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
2ea249c to
1bb8c08
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
1bb8c08 to
9c48e09
Compare
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
9c48e09 to
ba20694
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
ba20694 to
eebdad1
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
eebdad1 to
acd6b0b
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
acd6b0b to
397c661
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
397c661 to
5d29a6f
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
5d29a6f to
7c08130
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
7c08130 to
e504839
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
e504839 to
8724b12
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
8724b12 to
4484a5b
Compare
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
4484a5b to
3545db8
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
3545db8 to
acdf965
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/duende.identityserver.entityframework.storage-6.x
branch
from
acdf965 to
ede8530
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
deleted the
renovate/duende.identityserver.entityframework.storage-6.x
branch
renovate
bot
changed the title
renovate
bot
restored the
renovate/duende.identityserver.entityframework.storage-6.x
branch
renovate
bot
changed the title
renovate
bot
deleted the
renovate/duende.identityserver.entityframework.storage-6.x
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.1.1->6.3.10Release Notes
DuendeSoftware/IdentityServer (Duende.IdentityServer.EntityFramework.Storage)
v6.3.10Compare Source
This is a security hotfix that addresses CVE-2024-39694. See the security advisory for more details.
v6.3.9Compare Source
This is a patch release that updates our dependency on ASP.NET framework packages from version 6.0.0 (or 7.00) to version 6.0.26 (or 7.0.15). This updates our transitive dependency on the System.IdentityModel.Tokens.Jwt and Microsoft.IdentityModel.JsonWebTokens packages past versions that have a known Denial of Service vulnerability.
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.3.8...6.3.9
v6.3.8Compare Source
This is a minor release that improves error handling of grant deserialization.
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.3.7...6.3.8
v6.3.7Compare Source
This is a minor release that fixes two bugs.
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.3.6...6.3.7
v6.3.6Compare Source
This is a minor release that allows a method in the server side session store to be overridden.
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.3.5...6.3.6
v6.3.5Compare Source
This is a minor release that fixes a bug related to serialization of exceptions in the
UnhandledExceptionEvent.What's Changed
UnhandledExceptionEventfails to serialize (Yo dawg, I heard you like errors, so I threw an error in your error event...) See #1422.v6.3.4Compare Source
This is a minor release that fixes two bugs.
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.3.3...6.3.4
v6.3.3Compare Source
This is a minor release that fixes a bug in some narrow edge cases related to disabling server side sessions. The same fix was applied to the 6.2.x release branch in 6.2.4.
What's Changed
IsAuthenticatedin addition toSucceededwhen callingAuthenticateAsync. See #1356.Full Changelog: DuendeSoftware/IdentityServer@6.3.2...6.3.3
v6.3.2Compare Source
This is a minor release that fixes bugs related to nullable reference type annotations.
What's Changed
IIdentityInteractionService.GetErrorContextAsyncandIIdentityInteractionService.GetLogoutContextAsync. See #1304.IIdentityInteractionService.RevokeUserConsentAsync. See #1307.LogoutRequest. See #1304.PersistedGrantmodel. See #1304.Full Changelog: DuendeSoftware/IdentityServer@6.3.1...6.3.2
v6.3.1Compare Source
This is a minor release with small bug fixes.
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.3.0...6.3.1
v6.3.0Compare Source
This is a significant release that adds support for DPoP, Dynamic Client Registration, improves refresh token handling, and adds many other new features and bug fixes.
Breaking Changes
A new
ITokenCleanupServiceinterface has been extracted from theTokenCleanupService, and IdentityServer now depends on that interface, rather than the service itself. Customizations ofTokenCleanupServicethat previously were implemented by deriving from that class and registering the derived class in the DI system need toITokenCleanupService, andIServerSideSessionsMarkerfrom any calls to the base constructor.See issue #981.
The
TokenCleanupService.RemoveExpiredGrantsAsyncmethod was renamed toCleanupGrantsAsyncto reflect that it performs all grant cleanup work, including removing consumed grants and expired device codes in addition to expired grants. In the strictest sense, this is a breaking change, but it is very unlikely to cause issues during an upgrade because even thoughRemoveExpiredGrantsAsyncwas public, it was not virtual. If you were usingRemoveExpiredGrantsAsyncelsewhere, update your code to use the new name.See issue #981.
The value of the
typclaim in the header of Logout tokens has changed tologout+jwt, which complies with OpenID Connect Back-Channel Logout 1.0. Clients that were previously validating thetypneed to be updated, or the oldtypcan continue to be used via the newLogoutTokenJwtTypeconfiguration option.See issue #1169.
The
TokenResponseGenerator.ProcessTokenRequestAsyncvirtual method, which generates access and refresh tokens and adds them to a response object, is now called by all token flows except the refresh token flow. This unifies the programming and extensibility model of the generator, which previously had duplicated code in some flows. If you have overridden this virtual method, be aware that it will now be called in all flows. Previously, the authorization code flow, device code flow, and CIBA flow did not invoke this method.See pull request: #1178.
One time use (rotated) refresh tokens are now deleted immediately when they are used. If you rely on the existing behavior of marking refresh tokens as consumed (perhaps to allow for lenient rotations or replay detection), set the new
PersistentGrantOptions.DeleteOneTimeOnlyRefreshTokensOnUseoption to false.See issue #1102.
Schema Changes
New InitiateLoginUri string property added to the Client model. This is a nullable string that can be left null for existing clients. This column is used for Third Party Initiated Login.
New properties added to the Client Model for DPoP support:
DPoP
IdentityServer 6.3 adds support for OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) , a new OAuth specification for sender-constraining refresh tokens and access tokens. DPoP tokens can only be used by the client application that they are issued to, which provides a strong defense against replay attacks.
Our blog post announcing the feature is here, and detailed documentation is here.
See issues #1116 and #1266.
Configuration API/Dynamic Client Registration
IdentityServer 6.3 begins an effort to add programmatic configuration capabilities to IdentityServer. This configuration capability will take the form of a Configuration API that can be hosted either separately or within the IdentityServer implementation, and is distributed through the separate Duende.IdentityServer.Configuration nuget package.
This initial version of the Configuration API supports the OAuth and OIDC Dynamic Client Registration specifications, which allow a client or relying party to register their configuration details with IdentityServer dynamically by making standardized API requests. You could also use Dynamic Client Registration to provision environments automatically, perhaps in a deployment pipeline.
Our blog post announcing the feature is here, and detailed documentation is here.
See issue #111.
Client Application Portal
InitiateLoginUriis a new optional property added to the IdentityServer Client model that can be used to initiate login from the IdentityServer host. Typically this is used to create an application portal within the IdentityServer host, with links to the registered client applications. The UI templates now include an example of this portal.See issue #1124.
Initiate User Registration via OIDC
OIDC Relying Parties can now indicate that user registration is needed using the standardized
prompt=createparameter. To use this parameter, set theUserInteraction.CreateAccountUrloption to the location of your account creation page. The UI templates now include an example user registration page.See issues #1029 and #432.
Step-up Error Handling
OIDC Relying Parties can request particular requirements during authentication using the step-up process. For example, they might require two factor authentication before allowing a highly sensitive transaction. IdentityServer now supports the
unmet_authentication_requirementserror response code during step-up, which can be returned if IdentityServer is unable to fullfil the step-up requirements. If you set theErrorproperty of aConsentResponseorAuthorizeResponseto "unmet_authentication_requirements" (you can useIdentityModel.OidcConstants.AuthorizeErrors.UnmetAuthenticationRequirements), IdentityServer will return the error to the client.See issue #1133.
Refresh Token Cleanup
New configuration options (see below) have been added to control what happens to single use refresh tokens when they are used. If the new
DeleteOneTimeOnlyRefreshTokensOnUseflag is set, they will be immediately deleted. If you wish to keep consumed tokens for a period time for replay detection or to allow for leniency in the rotation policy, you can now add a delay using theConsumedTokenCleanupDelay, guaranteeing that consumed tokens will not be deleted for that amount of time.See issues #1102, #1065, and #982.
New Configuration Options
PersistentGrantOptions.DeleteOneTimeOnlyRefreshTokensOnUsecontrols what happens toRefreshTokenUsage.OneTimerefresh tokens when they are used. They can now be either marked as consumed or deleted immediately. The intent is that if you aren't making use of the consumed tokens you can safely delete them immediately. The default is to immediately delete.See issue #1102.
OperationalStoreOptions.ConsumedTokenCleanupDelaydelays deletion of consumed tokens in the token cleanup job. The intent of the delay is to allow users to keep tokens for some period of time to be used in some custom process. Custom code in theRefreshTokenServicecould allow "lenient" one-time use refresh tokens that can be reused for a short interval or detect token replay attacks by checking if a token is reused inappropriately. The default value for this new option is 0.See issue #1102.
LogoutTokenJwtTypesets thetypclaim in the header of logout tokens. Defaults tologout+jwt, which complies with OpenID Connect Back-Channel Logout 1.0.See issue #1029.
UserInteraction.CreateAccountUrlcontrols where the user is sent when theprompt=createparameter is sent as part of an OIDC login flow. Setting this option enables support for that parameter and is reflected in theprompt_values_supportedproperty of the discovery document. If it is not set,prompt=createwill be ignored.See issue: #432.
DPoP.ProofTokenValidityDurationsets the duration that DPoP proof tokens are considered valid. Defaults to 1 minute.See issue #1116
DPoP.ServerClockSkewsets the clock skew used when validating DPoP proof token expiration using a server-generated nonce value. Defaults to 0.See issue #1116
Extensibility and Other Miscellaneous Improvements
IdentityServerConstants.ProtocolRoutePathsconstants are now publicly accessibleSee issue #1201.
Added
IdentityServerConstants.ContentSecurityPolicyHashesconstants to facilitate creation of content security policies.See issue #1183.
Added
ITokenCleanupServiceinterface extracted fromTokenCleanupService, which can be used to customize token cleanup.See issue #981.
Added virtual method
ServerSideSessionStore.ApplyFilter, which can be used to customize how server side sessions are queried.Added
logout_reasonclaim to back-channel logout tokens, which describes why the logout token is being sent using the following values:user_logout- the user interactively logged outsession_expiration- the user's session expired due to inactivityterminated- the user's session was explicitly terminated by some other means (e.g. an admin)See issue #1198.
Added new overload of
IsRedirectUriValidAsynctoIRedirectUriValidatorthat is passed an object containing additional contextual information. The context contains the requested uri, the client making the request, the complete request parameters, and, if the request parameters were sent as a signed request object, the claims from the validated request object.See issue #44.
Endpoint names are now public constants in
IdentityServerConstants.EndpointNames, and the JWKS endpoint now has the unique nameIdentityServerConstants.EndpointNames.Jwks. Referencing endpoints by name is useful when invoking endpoints programmatically, for example, from a health check. It also facilitates the creation of a customIEndpointRouter.See issues #584 and #731.
Added nullable reference type annotations to many public APIs.
See issue #749.
Logging Improvements
Data protection failures now log a more detailed message.
See issues #973 and #851
Back-channel logout error responses now include more details in their log messages.
See issue #1026.
Licensing log messages related to multiple issuers (commonly caused by misconfigured gateways) and automatic key management are now more descriptive.
See issues #918 and #1017.
Logs generated in the CIBA flow now have sensitive values scrubbed by the
BackchannelAuthenticationRequestSensitiveValuesFilteroption, which scrubsclient_secret,client_assertion, andid_token_hintparameters from the logs. Previously these logs were filtered byTokenRequestSensitiveValuesFilter, which did not includeid_token_hint.See issue #1168.
Logs generated by the token endpoint now redact authorization codes from the raw request values that are logged. This is for consistency with the parsed value, which is logged as an obfuscated value. Previous logs that included codes should not be a concern, since codes are one time use only - by the time they are logged, they are not likely to be useful anymore.
See issue #1240.
Bug Fixes
Filtering sessions in the server side session quickstart UI uses the different filter fields properly
See issue #1111.
Requests to ~/federation with no additional segments returns not found instead of throwing an exception
See issue #1171.
Basic authorization header input length restrictions now account for base64-url encoding of client id and secret. The restrictions now apply to the length of those values before encoding.
See issue #1173.
Removed dependency on
IHttpContextAccessorin several services, making it possible to use them when no there is no HTTP request, such as in a customized background job. The updated services areDefaultEventService,PostConfigureApplicationCookieTicketStore,ConfigureAuthenticationOptions,OidcConfigureOptions,CachingIdentityProviderStoreandNonCachingIdentityProviderStore.See issue #874.
v6.2.5Compare Source
This is a security hotfix that addresses CVE-2024-39694. See the security advisory for more details.
v6.2.4Compare Source
This is a minor release that fixes a bug in some narrow edge cases related to disabling server side sessions. The same fix was applied to the 6.3.x release branch in 6.3.3.
What's Changed
IsAuthenticatedin addition toSucceededwhen callingAuthenticateAsync. See #1353.Full Changelog: DuendeSoftware/IdentityServer@6.2.3...6.2.4
v6.2.3Compare Source
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.2.2...6.2.3
v6.2.2Compare Source
What's Changed
New Contributors
Full Changelog: DuendeSoftware/IdentityServer@6.2.1...6.2.2
v6.2.1Compare Source
Full Changelog: DuendeSoftware/IdentityServer@6.2.0...6.2.1
Bug Fixes
Issue #1127 EmitIssuerIdentificationResponseParameter is reflected in discovery
v6.2.0Compare Source
What's Changed
Duende IdentityServer 6.2 adds:
.NET 7 Support
.NET 7
Filter Unhandled Exceptions
Bug Fixes
Updates to Dependencies
Samples and Documentation
Build, Test, Etc
New Contributors
Full Changelog: DuendeSoftware/IdentityServer@6.1.7...6.2.0
v6.1.8Compare Source
This is a security hotfix that addresses CVE-2024-39694. See the security advisory for more details.
v6.1.7Compare Source
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.1.6...6.1.7
v6.1.6Compare Source
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.1.5...6.1.6
v6.1.5Compare Source
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.1.4...6.1.5
v6.1.4Compare Source
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.1.3...6.1.4
v6.1.3Compare Source
What's Changed
Full Changelog: DuendeSoftware/IdentityServer@6.1.2...6.1.3
v6.1.2Compare Source
What's Changed
New Contributors
Full Changelog: DuendeSoftware/IdentityServer@6.1.1...6.1.2
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.