Skip to content

Commit 9bb175b

Browse files
maartenbamaartenba
authored
Merge pull request #772 from DuendeSoftware/release/is-7.3
IdentityServer 7.3
2 parents ced2e11 + 0574154 commit 9bb175b

File tree

14 files changed

+1811
-191
lines changed

14 files changed

+1811
-191
lines changed

‎src/content/docs/identityserver/diagnostics/data.mdx

Lines changed: 1033 additions & 0 deletions
Large diffs are not rendered by default.

‎src/content/docs/identityserver/diagnostics/otel.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -141,13 +141,16 @@ Note that the pages in the user interface are not IdentityServer endpoints and a
141141
| endpoint | The type name for the endpoint processor |
142142
| path | The path of the request |
143143

144-
### Detailed Metrics - Experimental
144+
### Detailed Metrics
145145

146146
These detailed metrics are instrumented by the IdentityServer middleware and services and track usage of specific
147-
flows and features. These metrics are created by the meter named "Duende.IdentityServer.Experimental", which is
148-
the value of the `Duende.IdentityServer.Telemetry.ServiceName.Experimental` constant.
149-
The definition and tags of these counters may be changed between releases. Once the counters and tags
150-
are considered stable they will be moved to the `Duende.IdentityServer.Telemetry.ServiceName` meter.
147+
flows and features.
148+
149+
:::note
150+
In IdentityServer versions <span data-shb-badge data-shb-badge-variant="default">&lt;7.3</span>,
151+
these metrics are created by the meter named "Duende.IdentityServer.Experimental", starting with IdentityServer 7.3,
152+
they are created by the meter named "Duende.IdentityServer".
153+
:::
151154

152155
#### Telemetry.Metrics.Counters.ApiSecretValidation
153156

‎src/content/docs/identityserver/overview/packaging.mdx

Lines changed: 201 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ redirect_from:
1111
- /identityserver/v7/overview/packaging/
1212
---
1313

14-
import { LinkCard, CardGrid } from "@astrojs/starlight/components";
14+
import {LinkCard, CardGrid} from "@astrojs/starlight/components";
1515

1616
## Product
1717

@@ -23,7 +23,7 @@ The licensed and supported libraries can be accessed via NuGet:
2323

2424
## Templates
2525

26-
Contains Duende templates for the `dotnet` CLI to help jump start your Duende-powered solutions.
26+
Contains Duende templates for the `dotnet` CLI to help jump-start your Duende-powered solutions.
2727

2828
:::note
2929
You may have a previous version of Duende templates (`Duende.IdentityServer.Templates`) installed on your machine.
@@ -37,26 +37,207 @@ dotnet new install Duende.Templates
3737
```
3838

3939
<CardGrid>
40-
<LinkCard
41-
description="NuGet Package for IdentityServer Templates"
42-
href="https://www.nuget.org/packages/Duende.Templates"
43-
title="Templates"
44-
target="_blank"
45-
/>
46-
<LinkCard
47-
description="Source code for IdentityServer Templates"
48-
href="https://github.com/DuendeSoftware/IdentityServer.Templates"
49-
title="Source Code"
50-
/>
40+
<LinkCard
41+
description="NuGet Package for IdentityServer Templates"
42+
href="https://www.nuget.org/packages/Duende.Templates"
43+
title="Templates"
44+
target="_blank"
45+
/>
46+
<LinkCard
47+
description="Source code for IdentityServer Templates"
48+
href="https://github.com/DuendeSoftware/IdentityServer.Templates"
49+
title="Source Code"
50+
/>
5151
</CardGrid>
5252

53-
## UI
53+
Running the command `dotnet new list duende` should give you a list of the following templates
5454

55-
Duende IdentityServer does not contain any UI, because this is always custom to the project.
56-
We still provide you with
57-
the [IdentityServer Quickstart UI](https://github.com/DuendeSoftware/products/tree/main/identity-server/templates/src/UI)
58-
as a starting point for your modifications.
55+
```bash
56+
Template Name Short Name Language Tags
57+
---------------------------------------------------------- -------------------- -------- -------------------------
58+
Duende BFF Host using a Remote API duende-bff-remoteapi [C#] Web/Duende/BFF
59+
Duende BFF using a Local API duende-bff-localapi [C#] Web/Duende/BFF
60+
Duende BFF with Blazor autorender duende-bff-blazor [C#] Web/Duende/BFF
61+
Duende IdentityServer Empty duende-is-empty [C#] Web/Duende/IdentityServer
62+
Duende IdentityServer Quickstart UI (UI assets only) duende-is-ui [C#] Web/IdentityServer
63+
Duende IdentityServer with ASP.NET Core Identity duende-is-aspid [C#] Web/Duende/IdentityServer
64+
Duende IdentityServer with Entity Framework Stores duende-is-ef [C#] Web/Duende/IdentityServer
65+
Duende IdentityServer with In-Memory Stores and Test Users duende-is-inmem [C#] Web/Duende/IdentityServer
66+
```
67+
68+
## Template Descriptions
69+
70+
In this section, we'll discuss what each IdentityServer template offers and why you would choose to start with it. While there are similarities across templates, there are nuances that can make for better starting points depending on your particular use case.
71+
72+
We'll start with the simplest templates and then move to the most feature-rich ones. Many of these templates build on each other's work, so moving from one to another is straightforward.
73+
74+
:::note
75+
All templates currently target .NET 8.0, but you can alter the target framework after creating the project to target higher framework versions.
76+
:::
77+
78+
All templates are provided as a starting point for your customization. Using the templates, you assume development responsibility for the choices, alterations, and inevitable deployment of your IdentityServer instance.
79+
80+
### Duende IdentityServer Empty
81+
82+
You want to run the following command to start using the **Duende IdentityServer Empty** template.
83+
84+
```bash
85+
dotnet new duende-is-empty
86+
```
87+
88+
Once created, this template has three essential files: `Config`, `HostingExtensions`, and `Program`.
89+
90+
You can modify the `Config` file to add clients, scopes, and claims, as all configurations are from in-memory objects.
91+
92+
```csharp
93+
public static class Config
94+
{
95+
public static IEnumerable<IdentityResource> IdentityResources =>
96+
new IdentityResource[]
97+
{
98+
new IdentityResources.OpenId()
99+
};
100+
101+
public static IEnumerable<ApiScope> ApiScopes =>
102+
new ApiScope[]
103+
{ };
104+
105+
public static IEnumerable<Client> Clients =>
106+
new Client[]
107+
{ };
108+
}
109+
```
110+
111+
This template doesn't include user interface elements, so it doesn't support OpenID Connect unless you add those UI elements. You can do so by running the UI-only template of `duende-is-ui`.
112+
113+
```bash
114+
dotnet new duende-is-ui --project <name of web app>
115+
```
116+
117+
The executed command will add Razor Pages to your web project. You will need to add Razor Pages to your `HostingExtensions` file.
118+
119+
```csharp
120+
using Serilog;
121+
122+
internal static class HostingExtensions
123+
{
124+
public static WebApplication ConfigureServices(this WebApplicationBuilder builder)
125+
{
126+
builder.Services.AddRazorPages();
127+
128+
builder.Services.AddIdentityServer()
129+
.AddInMemoryIdentityResources(Config.IdentityResources)
130+
.AddInMemoryApiScopes(Config.ApiScopes)
131+
.AddInMemoryClients(Config.Clients)
132+
.AddLicenseSummary();
133+
134+
return builder.Build();
135+
}
136+
137+
public static WebApplication ConfigurePipeline(this WebApplication app)
138+
{
139+
app.UseSerilogRequestLogging();
140+
141+
if (app.Environment.IsDevelopment())
142+
{
143+
app.UseDeveloperExceptionPage();
144+
}
145+
146+
app.UseStaticFiles();
147+
app.UseRouting();
148+
149+
app.UseIdentityServer();
150+
app.UseAuthorization();
151+
app.MapRazorPages().RequireAuthorization();
152+
153+
return app;
154+
}
155+
}
156+
```
157+
158+
### Duende IdentityServer with In-Memory Stores and Test Users
159+
160+
The `duende-is-inmem` template is similar to the `duende-is-empty` and `duende-is-ui` templates combined into a single project template.
161+
162+
```bash
163+
dotnet new duende-is-inmem
164+
```
165+
166+
This template differs from others in that we have defined some starting clients, scopes, and claims for common development scenarios and a speedier development experience.
167+
168+
```csharp
169+
// Config.cs
170+
public static class Config
171+
{
172+
public static IEnumerable<IdentityResource> IdentityResources =>
173+
new IdentityResource[]
174+
{
175+
new IdentityResources.OpenId(),
176+
new IdentityResources.Profile(),
177+
};
178+
179+
public static IEnumerable<ApiScope> ApiScopes =>
180+
new ApiScope[]
181+
{
182+
new ApiScope("scope1"),
183+
new ApiScope("scope2"),
184+
};
185+
186+
public static IEnumerable<Client> Clients =>
187+
new Client[]
188+
{
189+
// m2m client credentials flow client
190+
new Client
191+
{
192+
ClientId = "m2m.client",
193+
ClientName = "Client Credentials Client",
194+
195+
AllowedGrantTypes = GrantTypes.ClientCredentials,
196+
ClientSecrets = { new Secret("511536EF-F270-4058-80CA-1C89C192F69A".Sha256()) },
197+
198+
AllowedScopes = { "scope1" }
199+
},
200+
201+
// interactive client using code flow + pkce
202+
new Client
203+
{
204+
ClientId = "interactive",
205+
ClientSecrets = { new Secret("49C1A7E1-0C79-4A89-A3D6-A37998FB86B0".Sha256()) },
206+
207+
AllowedGrantTypes = GrantTypes.Code,
208+
209+
RedirectUris = { "https://localhost:44300/signin-oidc" },
210+
FrontChannelLogoutUri = "https://localhost:44300/signout-oidc",
211+
PostLogoutRedirectUris = { "https://localhost:44300/signout-callback-oidc" },
212+
213+
AllowOfflineAccess = true,
214+
AllowedScopes = { "openid", "profile", "scope2" }
215+
},
216+
};
217+
}
218+
```
219+
220+
This template is a great starting point for proof of concepts and a learning tool for developers experiencing OAuth 2.0 and OpenID Connect in the .NET space for the first time.
221+
222+
### Duende IdentityServer with Entity Framework Stores
223+
224+
For developers looking to quickly go to a production-like environment, starting with the `duende-is-ef` template is a great starting point.
225+
226+
```bash
227+
dotnet new duende-is-ef
228+
```
229+
230+
This template stores all operational and configuration data of the IdentityServer instance in your chosen data storage, utilizing EF Core's ability to target multiple database engines.
231+
232+
The template targets SQLite by default, but we have included scripts to easily swap out and regenerate migrations for your database.
233+
234+
[Read more about the Entity Framework Core setup here.](/identityserver/data/ef)
235+
236+
### Duende IdentityServer with ASP.NET Core Identity
237+
238+
The **Duende IdentityServer with ASP.NET Core Identity** template integrates with ASP.NET Identity to
239+
provide you with an instance of Duende IdentityServer that has a user store powered by the Microsoft
240+
library.
59241

60-
## Source Code
242+
[Please read our ASP.NET Identity documentation](/identityserver/aspnet-identity/), to learn more about this integration.
61243

62-
You can find the Duende IdentityServer source code on [GitHub](https://github.com/duendesoftware/IdentityServer).

‎src/content/docs/identityserver/overview/specs.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,7 @@ Duende IdentityServer implements the following specifications:
2323
* OpenID Connect Back-Channel Logout 1.0 ([spec](https://openid.net/specs/openid-connect-backchannel-1_0.html))
2424
* Multiple Response Types ([spec](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html))
2525
* Form Post Response Mode ([spec](https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html))
26-
* Enterprise Edition: OpenID Connect Client-Initiated Backchannel Authentication (
27-
CIBA) ([spec](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html)).
26+
* Enterprise Edition: OpenID Connect Client-Initiated Backchannel Authentication (CIBA) ([spec](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html)).
2827

2928
## OAuth 2.x
3029

@@ -50,3 +49,5 @@ Duende IdentityServer implements the following specifications:
5049
* Enterprise Edition: Resource Indicators for OAuth 2.0 ([RFC 8707](https://tools.ietf.org/html/rfc8707))
5150
* Enterprise Edition: OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer /
5251
DPoP ([RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449))
52+
* FAPI 2.0 Security Profile ([spec](https://openid.net/specs/fapi-security-profile-2_0-final.html))
53+
* JSON Web Token (JWT) Response for OAuth Token Introspection ([RFC 9701](https://www.rfc-editor.org/rfc/rfc9701.html))

‎src/content/docs/identityserver/reference/endpoints/introspection.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,48 @@ Unknown or expired tokens will be marked as inactive:
6464

6565
An invalid request will return a 400, an unauthorized request 401.
6666

67+
## JWT Response from Introspection Endpoint :badge[v7.3]
68+
69+
IdentityServer supports [RFC 9701](https://www.rfc-editor.org/rfc/rfc9701.html) to return a JWT response from the
70+
introspection endpoint.
71+
72+
To return a JWT response, set the `Accept` header in the HTTP request to `application/token-introspection+jwt`:
73+
74+
```text
75+
POST /connect/introspect
76+
Accept: application/token-introspection+jwt
77+
Authorization: Basic xxxyyy
78+
79+
token=<token>
80+
```
81+
82+
A successful response will return a status code of 200 and has a `Content-Type: application/token-introspection+jwt` header,
83+
indicating that the response body contains a raw JWT instead. The base64 decoded JWT will have a `typ` claim in the header with
84+
the value `token-introspection+jwt`. The token's payload contains a `token_introspection` JSON object similar to the default response type:
85+
86+
```json
87+
{
88+
"alg": "RS256",
89+
"kid": "BE9D78519A8BBCB28A65FADEECF49CBC",
90+
"typ": "token-introspection+jwt"
91+
}.{
92+
"iss": "https://localhost:5001",
93+
"iat": 1729599599,
94+
"aud": "api1",
95+
"token_introspection": {
96+
"iss": "https://localhost:5001",
97+
"nbf": 1729599599,
98+
"iat": 1729599599,
99+
"exp": 1729603199,
100+
"aud": [ "api1" ],
101+
"client_id": "client",
102+
"jti": "44FD2DE9E9F8E9F4DDD141CD7C244BE9",
103+
"active": true,
104+
"scope": "api1"
105+
}
106+
}.[Signature]
107+
```
108+
67109
## .NET Client Library
68110

69111
You can use the [Duende IdentityModel](/identitymodel/index.mdx) client library to programmatically interact with

0 commit comments

Comments
 (0)