A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Fallback to previous behavior via an AppContext switch. See PR #2700 for details.
Make CollectionUtilities.IsNullOrEmpty internal. See issues #2651 and #1722 for details.
Overall improvements to the validation in IdentityModel:
See design proposal #2711 for details, all work internal for now. Please comment in the GitHub issue and provide feedback there.
New Features:
Allow users to provide a Stream to Write in OIDCConfigurationSerializer. See PR #2698 for details.
Bug fixes:
Remove dependency on AadIssuerValidator.GetTenantIdFromToken in ValidateIssuerSigningKey, to only consider the tid. An AppContext switch enables fallbacking to the previous behavior, which should not be needed. See PR #2680 for details.
Serialize byte arrays as base64 strings in Json tokens. This was the behavior in 6.x releases. See issue #2524 for details.
When we added virtuals to abstract methods that threw in the base class, we then called those methods that were implemented in user derived classes. The user code would fault with a NotImplementedException. Now a message is returned that the user can act on to fix the issue. See issue #1970.
Fundamentals
Remove code that was used in target frameworks that got removed. See PR #2673 for details.
Rename local variables for better readability. See PR #2674 for details.
Refactor XML comments for improved clarity. See PR #2676, #2677, #2678, #2689 and #2703 for details.
Made ConfigurationManager.GetConfigurationAsync a virtual method. See PR #2661
8.0.0-preview1
Breaking changes:
IdentityModel 8x no longer supports .net461, which has reached end of life and is no longer supported. See issue #2544 for details.
Two IdentityModel extension dlls Microsoft.IdentityModel.KeyVaultExtensions and Microsoft.IdentityModel.ManagedKeyVaultSecurityKey were using ADAL, which is no longer supported . The affected packages have been removed, as the replacement is to use Microsoft.Identity.Web. See issue #2454 for details.
AppContext.SetSwitch which were included in IdentityModel 7x, have been removed and are the default in IdentityModel 8x. The result is a more performant IdentityModel by default. See issue #2629 and https://aka.ms/IdentityModel8x for details.
7.7.1
Bug Fix
Re-add JsonSerializerPrimitives.TryAllStringClaimsAsDateTime which was removed as it is in an internal class, but due to InternalsVisibleTo can lead to a MissingMethodException if IdentityModel versions are not aligned. See PR #2734 for details.
A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Fallback to previous behavior via an AppContext switch. See PR #2700 for details.
Make CollectionUtilities.IsNullOrEmpty internal. See issues #2651 and #1722 for details.
Overall improvements to the validation in IdentityModel:
See design proposal #2711 for details, all work internal for now. Please comment in the GitHub issue and provide feedback there.
New Features:
Allow users to provide a Stream to Write in OIDCConfigurationSerializer. See PR #2698 for details.
Bug fixes:
Remove dependency on AadIssuerValidator.GetTenantIdFromToken in ValidateIssuerSigningKey, to only consider the tid. An AppContext switch enables fallbacking to the previous behavior, which should not be needed. See PR #2680 for details.
Serialize byte arrays as base64 strings in Json tokens. This was the behavior in 6.x releases. See issue #2524 for details.
When we added virtuals to abstract methods that threw in the base class, we then called those methods that were implemented in user derived classes. The user code would fault with a NotImplementedException. Now a message is returned that the user can act on to fix the issue. See issue #1970.
Fundamentals
Remove code that was used in target frameworks that got removed. See PR #2673 for details.
Rename local variables for better readability. See PR #2674 for details.
Refactor XML comments for improved clarity. See PR #2676, #2677, #2678, #2689 and #2703 for details.
Made ConfigurationManager.GetConfigurationAsync a virtual method. See PR #2661
8.0.0-preview1
Breaking changes:
IdentityModel 8x no longer supports .net461, which has reached end of life and is no longer supported. See issue #2544 for details.
Two IdentityModel extension dlls Microsoft.IdentityModel.KeyVaultExtensions and Microsoft.IdentityModel.ManagedKeyVaultSecurityKey were using ADAL, which is no longer supported . The affected packages have been removed, as the replacement is to use Microsoft.Identity.Web. See issue #2454 for details.
AppContext.SetSwitch which were included in IdentityModel 7x, have been removed and are the default in IdentityModel 8x. The result is a more performant IdentityModel by default. See issue #2629 and https://aka.ms/IdentityModel8x for details.
7.6.1
New Features:
Added an Audiences member to the SecurityTokenDescriptor to make it easier to define multiple audiences in JWT and SAML tokens. Addresses issue #1479 with PR #2575
Add missing metadata parameters to OpenIdConnectConfiguration. See issue #2498 for details.
Bug Fixes:
Fix over-reporting of IDX14100. See issue #2058 and PR #2618 for details.
JwtRegisteredClaimNames now contains previously missing Standard OpenIdConnect claims. See issue #1598 for details.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps Microsoft.IdentityModel.JsonWebTokens from 7.6.3 to 8.0.0.
Release notes
Sourced from Microsoft.IdentityModel.JsonWebTokens's releases.
... (truncated)
Changelog
Sourced from Microsoft.IdentityModel.JsonWebTokens's changelog.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show