Skip to content
This repository has been archived by the owner on Nov 19, 2024. It is now read-only.

3.0.0-preview.1

Pre-release
Pre-release
Compare
Choose a tag to compare
@josephdecock josephdecock released this 06 May 23:25
· 39 commits to main since this release
3.0.0-preview.1
5c41c64
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

This is a preview release of Duende.AccessTokenManagement and Duende.AccessTokenManagement.OpenIdConnect v3.0.0. The highlights of this major release include

  • Improved support for Blazor Server
  • Updates to dependencies
  • Bug fixes and improvements

Breaking Changes

  • Support for .NET 6 and 7 has been dropped, as Microsoft will no longer be supporting those versions in the coming weeks or months. Duende.AccessTokenManagement Version 2.1 (which supports .NET 6 and 7) will continue to be supported until .NET 6 reaches end of life in November.
  • The OpenIdConnectUserAccessTokenHandler no longer depends on HttpContext, and instead depends on the new IUserAccessor interface. This change allows us to use the handler in Blazor Server projects. If you have customized the handler in a derived class, update your derived class's constructor to depend on the IUserAccessor and pass that to the handler's constructor. You probably don't need to implement IUserAccessor - the default implementation of the IUserAccessor is registered automatically and accesses the current user from the HttpContext, and a blazor server specific implementation is also available.
  • The OpenIdConnectUserAccessTokenHandler also now takes a direct dependency on the IUserTokenManagementService, rather than resolving it from the HttpContext. Again, if you have customized the handler in a derived class, you'll need to update constructors.

Blazor Server Support

This release improves our support for Blazor Server. We've added a new method to use when registering services: AddBlazorServerAccessTokenManagement. This method sets up dependencies needed specifically in a Blazor Server environment, including retrieving the current user without using HttpContext when it is not available. This simplifies creating HttpClients that use the current user's access token.

Blazor Server implementations have always required a server side token store (an implementation of ITokenStore). You should pass your implementation of ITokenStore to AddBlazorServerAccessTokenManagement a type parameter.

We've also exposed the logic related to storage of tokens in an AuthenticationTicket as a new service.

Dependencies

  • We now depend on:
    • version 7.0.0 or later of IdentityModel
    • version 8.0.1 or later of the ASP.NET OpenIdConnect Authentication Handler (Microsoft.AspNetCore.Authentication.OpenIdConnect)
    • version 7.1.2 or later of the Microsoft JWT Handler (System.IdentityModel.Tokens.Jwt)

Our approach for dependencies is to depend on the minimum patch version that accomplishes
the following:

  • Avoid depending on a version of a package that has a known security vulnerability
  • Avoid depending on a version that has a transitive dependency on a version of a package that has a known vulnerability
  • Depend on the same version of the Microsoft JWT handler as the ASP.NET OpenIdConnect Authentication Handler

Full Changelog

Blazor Support

Bugs and Improvements

  • Keep previous refresh token if not updated during refresh by @hybrid2102 in #46
  • Add a specific exception when the clientId is empty by @kallayj in #73
  • Remove space from closing a tag in Index.cshtml by @RolandGuijt in #72

Dependencies

  • Updated System.IdentityModel.Tokens.Jwt and Microsoft.IdentityModel.JsonWebTokens to latest to address CVEs by @chgl in #53
  • Updateed System.IdentityModel.Tokens.Jwt and Microsoft.AspNetCore.Authentication.* by @josephdecock in #92
  • Update IdentityModel to v7.0.0 by @josephdecock in #93
  • Drop support for .NET 6/7 by @josephdecock in #98

Dependabot

Contributors

josephdecock, hybrid2102, and 5 other contributors
Assets 2
Loading