ForgePoint.Identity: IdentityServer4 continuation for .NET 8/10 - #1
Merged
Merged
Conversation
Retarget libraries to net8.0 and net10.0, replace ISystemClock with IClock/TimeProvider, and fix CVE-2024-39694 local URL validation. Add RFC 9126 pushed authorization at /connect/par and an AddIdentityServer health check. Adapt JWT/JWK handling for IdentityModel 8 (strict JSON, JsonElement payloads, Newtonsoft JWK fallback) so existing secrets and request objects still work. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
Qualify Microsoft.IdentityModel.Tokens.JsonWebKey so it is not confused with IdentityServer4.Models.JsonWebKey. Send private_key_jwt client assertions as POST body for IdentityModel 6. Adapt EF tests to AutoMapper 13 and .NET 10 LINQ SelectMany ambiguity. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
AutoMapper 13 is not licensed for this project and produced restore warnings. Public ToModel/ToEntity APIs are unchanged; AutoMapper profiles are removed as a 10.x breaking change. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
cursor
Bot
changed the title
Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
Publish as ForgePoint Labs packages while keeping IdentityServer4 namespaces and AddIdentityServer() for drop-in source compatibility. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
cursor
Bot
changed the title
C# namespaces are now ForgePoint.Identity.* while AddIdentityServer() and IdentityServer* type names stay. A Python rewriter plus docs cover package ids, usings, and EF snapshots for existing apps. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
tools/ is gitignored for local .NET CLI tools, so the rewriter lives in scripts/upgrade-namespaces instead. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
Package rewrite now only touches PackageReference/PackageId values, friend assemblies stay IdentityServer4.*, and the repo build drops cached ForgePoint.Identity nupkgs so same-height MinVer packs are actually used. Co-authored-by: Jeff Jones <joneja09@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ForgePoint.Identity is a ForgePoint Labs Apache-2.0 continuation of IdentityServer4, upgraded for .NET 8/10.
Why
IdentityServer4 stopped at 4.1.2 on .NET Core 3.1. This line retargets the libraries and hosts, includes the CVE-2024-39694 local-URL fix, and adds PAR plus health checks. The product is ForgePoint.Identity: new package IDs and
ForgePoint.Identity.*namespaces.AddIdentityServer()andIdentityServer*type names stay so the protocol surface is familiar.Existing apps can swap packages and run
scripts/upgrade-namespaces(see docs/upgrade.md). Preview with--dry-run. The rewriter updates usings, namespaces, EF snapshot CLR names, andPackageReference/PackageIdvalues. It does not renameAddIdentityServer, friend-test assemblies, or on-diskIdentityServer4*.csprojfile names.This project is not affiliated with or endorsed by Duende Software or the original IdentityServer4 authors.
What changed
ForgePoint.Identity,.Storage,.EntityFramework,.EntityFramework.Storage,.AspNetIdentityIdentityServer4.*→ForgePoint.Identity.*scripts/upgrade-namespaces,docs/upgrade.md)./build.shdrops cachedforgepoint.identity*nupkgs so a same-height MinVer rebuild is actually restorednet8.0;net10.0; hosts, samples, and tests targetnet10.0IsLocalUrlrejects control characters and embedded backslashes (CVE-2024-39694)IClock/DefaultClock(TimeProvider) replace ASP.NETISystemClock/connect/parAddHealthChecks().AddIdentityServer()Test plan
python3 scripts/upgrade-namespaces/test_rewrite.py(8 tests)./build.shafter package rebrand./build.shafter namespace rename: 740 unit + 296 integration (1 skip) + EF Storage 13+80 + EF 4ForgePoint.Identity.*namespaces; no AutoMapper