ForgePoint.Identity: IdentityServer4 continuation for .NET 8/10

.config/dotnet-tools.json

@@ -9,10 +9,10 @@
       ]
     },
     "dotnet-ef": {
-      "version": "3.1.0",
+      "version": "8.0.11",
       "commands": [
         "dotnet-ef"
       ]
     }
   }
-}
+}

.github/CONTRIBUTING.md

@@ -6,7 +6,7 @@ Then we can decide if and how a feature or a change could be implemented and if
 Also read this first: [Being a good open source citizen](https://hackernoon.com/being-a-good-open-source-citizen-9060d0ab9732#.x3hocgw85)
 
 ## Found an issue or a bug?
-Please start a discussion on the [core repo issue tracker](https://github.com/IdentityServer/IdentityServer4/issues).
+Please start a discussion on the [repository issue tracker](https://github.com/joneja09/IdentityServer4/issues).
 
 ## Filing issues
 The best way to get your bug fixed is to be as detailed as you can be about the problem.

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches:
     - main
     - features/**
+    - cursor/**
     tags:
     - '*.*.*'
   pull_request:
@@ -21,8 +22,18 @@ jobs:
     name: ${{ matrix.runs-on }}
     runs-on: ${{ matrix.runs-on }}
     steps:
-    - uses: actions/checkout@af513c7a016048ae468971c52ed77d9562c7c819
+    - uses: actions/checkout@v4
+    - uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: |
+          8.0.x
+          10.0.x
     - run: dotnet --info
+
+    - name: Upgrade script tests
+      if: contains(matrix.runs-on, 'macOS') || contains(matrix.runs-on, 'ubuntu')
+      working-directory: scripts/upgrade-namespaces
+      run: python3 test_rewrite.py
 
     - if: contains(matrix.runs-on, 'macOS') || contains(matrix.runs-on, 'ubuntu')
       run: ./build.sh

.gitignore

@@ -211,4 +211,8 @@ samples/KeyManagement/FileSystem/signingkeys/
 workspace.xml
 
 src/IdentityServer4/host/identityserver.db
-tempkey.jwk
+tempkey.jwk
+
+# Python (upgrade script tests)
+__pycache__/
+*.py[cod]

NuGet.config

@@ -3,6 +3,6 @@
   <packageSources>
 	<clear/>
     <add key="NuGet" value="https://api.nuget.org/v3/index.json" />
-    <add key="IdentityServer Local" value="./nuget" />
+    <add key="ForgePoint.Identity Local" value="./nuget" />
   </packageSources>
 </configuration>

README.md

@@ -1,69 +1,88 @@
-# Security Vulnerability Found
-IdentityServer4 contains a known Open Redirect vulnerability (CVE-2024-39694) that we do not intend to address in IdentityServer4. Please see [the security advisory](https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366) for more details and consider upgrading to [Duende.IdentityServer](www.duendesoftware.com) to receive updates.
+# ForgePoint.Identity
 
-# Important update
-This project is not maintained anymore. This repo will be archived when .NET Core 3.1 end of support is reached (13th Dec 2022). All new development is happening in the new [Duende Software](https://github.com/duendesoftware) organization. 
+ForgePoint.Identity is a free, open source [OpenID Connect](https://openid.net/connect/) and [OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc6749) framework for ASP.NET Core. It is maintained by **ForgePoint Labs** as an Apache-2.0 continuation of the last IdentityServer4 release, upgraded for current .NET and expanded with protocol and hosting features that modern apps expect.
 
-See [here](https://duendesoftware.com/products/identityserver) for more details.
+It remains licensed under [Apache 2.0](https://opensource.org/licenses/Apache-2.0). This project is not affiliated with or endorsed by Duende Software or the original IdentityServer4 authors.
 
-## About IdentityServer4
-[<img align="right" width="100px" src="https://dotnetfoundation.org/img/logo_big.svg" />](https://dotnetfoundation.org/projects?searchquery=IdentityServer&type=project)
+`AddIdentityServer()` stays the same. C# namespaces move from `IdentityServer4.*` to `ForgePoint.Identity.*` — see the [upgrade guide](docs/upgrade.md) and `scripts/upgrade-namespaces`.
 
-IdentityServer is a free, open source [OpenID Connect](http://openid.net/connect/) and [OAuth 2.0](https://tools.ietf.org/html/rfc6749) framework for ASP.NET Core.
-Founded and maintained by [Dominick Baier](https://twitter.com/leastprivilege) and [Brock Allen](https://twitter.com/brocklallen), IdentityServer4 incorporates all the protocol implementations and extensibility points needed to integrate token-based authentication, single-sign-on and API access control in your applications.
-IdentityServer4 is officially [certified](https://openid.net/certification/) by the [OpenID Foundation](https://openid.net) and thus spec-compliant and interoperable.
-It is part of the [.NET Foundation](https://www.dotnetfoundation.org/), and operates under their [code of conduct](https://www.dotnetfoundation.org/code-of-conduct). It is licensed under [Apache 2](https://opensource.org/licenses/Apache-2.0) (an OSI approved license).
+## What's new in 10.x
 
-For project documentation, please visit [readthedocs](https://identityserver4.readthedocs.io).
+- **ForgePoint.Identity** package IDs and `ForgePoint.Identity.*` namespaces (was IdentityServer4)
+- Upgrade script for existing apps: `scripts/upgrade-namespaces`
+- **.NET 8 and .NET 10** target frameworks for all libraries
+- **CVE-2024-39694** open-redirect fix in local URL validation
+- **Pushed Authorization Requests** (RFC 9126) at `/connect/par`
+- **Health checks** via `AddHealthChecks().AddIdentityServer()`
+- **`IClock` / `TimeProvider`** instead of the removed ASP.NET `ISystemClock`
+- **Handwritten EF entity/model mappings** instead of AutoMapper (no AutoMapper license required)
+- Package and test dependencies updated for current .NET
 
-## Branch structure
-Active development happens on the main branch. This always contains the latest version. Each (pre-) release is tagged with the corresponding version. The [aspnetcore1](https://github.com/IdentityServer/IdentityServer4/tree/aspnetcore1) and [aspnetcore2](https://github.com/IdentityServer/IdentityServer4/tree/aspnetcore2) branches contain the latest versions of the older ASP.NET Core based versions.
+Duende IdentityServer is the commercial successor of the original IdentityServer project.
+
+## Packages
+
+| Package | Role |
+| --- | --- |
+| `ForgePoint.Identity` | Protocol implementation and ASP.NET Core host integration |
+| `ForgePoint.Identity.Storage` | Store contracts and models |
+| `ForgePoint.Identity.EntityFramework` | EF Core configuration and operational stores |
+| `ForgePoint.Identity.EntityFramework.Storage` | EF Core entities and stores |
+| `ForgePoint.Identity.AspNetIdentity` | ASP.NET Core Identity integration |
 
 ## How to build
 
-* [Install](https://www.microsoft.com/net/download/core#/current) the latest .NET Core 3.1 SDK
+* Install the [.NET 10 SDK](https://dotnet.microsoft.com/download) (the SDK also builds the `net8.0` TFM)
 * Install Git
 * Clone this repo
-* Run `build.ps1` or `build.sh` in the root of the cloned repo
+* Run `build.sh` or `build.ps1` from the repository root
 
-## Documentation
-For project documentation, please visit [readthedocs](https://identityserver4.readthedocs.io).
+The build packs each project into `./nuget` in dependency order: Storage → Identity → EntityFramework.Storage → EntityFramework → AspNetIdentity.
 
-See [here](http://docs.identityserver.io/en/aspnetcore1/) for the 1.x docs, and [here](http://docs.identityserver.io/en/aspnetcore2/) for the 2.x docs.
+## Quick start
 
-## Bug reports and feature requests
-Please use the [issue tracker](https://github.com/IdentityServer/IdentityServer4/issues) for that. We only support the latest version for free. For older versions, you can get a commercial support agreement with us.
+```csharp
+builder.Services.AddIdentityServer(options =>
+    {
+        options.Events.RaiseSuccessEvents = true;
+        options.Events.RaiseFailureEvents = true;
+        options.Events.RaiseErrorEvents = true;
+        options.PushedAuthorization.Required = false; // set true to require PAR globally
+    })
+    .AddInMemoryClients(Clients.Get())
+    .AddInMemoryIdentityResources(Resources.IdentityResources)
+    .AddInMemoryApiScopes(Resources.ApiScopes)
+    .AddDeveloperSigningCredential();
 
-## Commercial and Community Support
-If you need help with implementing IdentityServer4 or your security architecture in general, there are both free and commercial support options.
-See [here](https://identityserver4.readthedocs.io/en/latest/intro/support.html) for more details.
+builder.Services.AddHealthChecks()
+    .AddIdentityServer();
 
-## Sponsorship
-If you are a fan of the project or a company that relies on IdentityServer, you might want to consider sponsoring.
-This will help us devote more time to answering questions and doing feature development. If you are interested please head to our [Patreon](https://www.patreon.com/identityserver) page which has further details.
+app.UseIdentityServer();
+app.MapHealthChecks("/health");
+```
 
-### Platinum Sponsors
-[<img src="https://user-images.githubusercontent.com/1454075/62819413-39550c00-bb55-11e9-8f2f-a268c3552c71.png" width="200">](https://udelt.no)
+Enable PAR per client with `Client.RequirePushedAuthorization = true`, or for every client with `options.PushedAuthorization.Required = true`.
 
-[<img src="https://user-images.githubusercontent.com/1454075/66454740-fb973580-ea68-11e9-9993-6c1014881528.png" width="200">](https://github.com/dotnet-at-microsoft)
+Existing IdentityServer4 4.x configuration databases need one additive column:
 
-### Corporate Sponsors
-[Ritter Insurance Marketing](https://www.ritterim.com)  
-[ExtraNetUserManager](https://www.extranetusermanager.com/)  
-[Knab](https://www.knab.nl/)
+```sql
+ALTER TABLE [Clients] ADD [RequirePushedAuthorization] bit NOT NULL DEFAULT 0;
+```
+
+A script is included at `docs/migrations/add-require-pushed-authorization.sql`.
+
+## Documentation
 
-You can see a list of our current sponsors [here](https://github.com/IdentityServer/IdentityServer4/blob/main/SPONSORS.md) - and for companies we have some nice advertisement options as well.
+Upgrade from IdentityServer4: [docs/upgrade.md](docs/upgrade.md).
+
+Historical IdentityServer4 docs: [https://identityserver4.readthedocs.io](https://identityserver4.readthedocs.io).
+
+PAR is described in [RFC 9126](https://www.rfc-editor.org/rfc/rfc9126). The discovery document advertises `pushed_authorization_request_endpoint` when the endpoint is enabled.
+
+## Security
+
+See [SECURITY.MD](SECURITY.MD). IdentityServer4 4.1.2 and earlier are affected by [CVE-2024-39694](https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366). This 10.x line includes the local-URL validation fix.
 
 ## Acknowledgements
-IdentityServer4 is built using the following great open source projects and free services:
-
-* [ASP.NET Core](https://github.com/dotnet/aspnetcore)
-* [Bullseye](https://github.com/adamralph/bullseye)
-* [SimpleExec](https://github.com/adamralph/simple-exec)
-* [MinVer](https://github.com/adamralph/minver)
-* [Json.Net](http://www.newtonsoft.com/json)
-* [XUnit](https://xunit.github.io/)
-* [Fluent Assertions](http://www.fluentassertions.com/)
-* [GitReleaseManager](https://github.com/GitTools/GitReleaseManager)
-
-..and last but not least a big thanks to all our [contributors](https://github.com/IdentityServer/IdentityServer4/graphs/contributors)!
+
+ForgePoint.Identity is built using ASP.NET Core, IdentityModel, Newtonsoft.Json, xUnit, Fluent Assertions, MinVer, Bullseye, and SimpleExec — and the work of [every contributor](https://github.com/IdentityServer/IdentityServer4/graphs/contributors) to the original IdentityServer4 project.

SECURITY.MD

@@ -1,7 +1,7 @@
 # Reporting Security Issues
 
-If you discover a security issue in IdentityServer, please report it by sending an email to contact@identityserver.io
+If you discover a security issue in ForgePoint.Identity, please open a private GitHub security advisory on the repository.
 
-This will allow us to assess the risk, and make a fix available before we add a bug report to the GitHub repository.
+This 10.x line includes a fix for CVE-2024-39694 (open redirect via crafted local URLs). IdentityServer4 4.1.2 and earlier remain affected.
 
-Thanks!
+Do not file public issues for unreleased vulnerabilities until a fix is available.

build.ps1

@@ -1,6 +1,14 @@
 $ErrorActionPreference = "Stop";
 
-New-Item -ItemType Directory -Force -Path ./nuget
+if (Test-Path ./nuget) {
+    Remove-Item ./nuget -Recurse -Force
+}
+New-Item -ItemType Directory -Force -Path ./nuget | Out-Null
+
+$nugetPackages = if ($env:NUGET_PACKAGES) { $env:NUGET_PACKAGES } else { Join-Path $env:USERPROFILE ".nuget\packages" }
+Get-ChildItem -Path $nugetPackages -Directory -ErrorAction SilentlyContinue |
+    Where-Object { $_.Name -like "forgepoint.identity*" } |
+    Remove-Item -Recurse -Force
 
 dotnet tool restore
 

build.sh

@@ -4,6 +4,11 @@ set -euo pipefail
 rm -rf nuget
 mkdir nuget
 
+# Same-height MinVer packs reuse the global cache. Drop local ForgePoint.Identity
+# packages so restore picks up the nupkgs just written to ./nuget.
+nuget_packages="${NUGET_PACKAGES:-$HOME/.nuget/packages}"
+rm -rf "$nuget_packages"/forgepoint.identity*
+
 dotnet tool restore
 
 pushd ./src/Storage

docs/migrations/add-require-pushed-authorization.sql

@@ -0,0 +1,13 @@
+-- Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+-- Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+-- Additive schema change for IdentityServer4 10: RFC 9126 PAR client flag.
+-- Safe to run against existing IdentityServer4 4.x databases.
+
+IF COL_LENGTH('dbo.Clients', 'RequirePushedAuthorization') IS NULL
+BEGIN
+    ALTER TABLE [dbo].[Clients]
+    ADD [RequirePushedAuthorization] bit NOT NULL
+        CONSTRAINT [DF_Clients_RequirePushedAuthorization] DEFAULT (0);
+END
+GO

docs/readme.md

@@ -1,4 +1,6 @@
-# IdentityServer4 documentation
+# ForgePoint.Identity documentation
+
+Historical IdentityServer4 documentation lives in this folder and on [Read the Docs](https://identityserver4.readthedocs.io). ForgePoint.Identity keeps those APIs; new protocol features such as PAR are described in the repository README.
 
 The folder contains the documentation for identityserver4.
 

docs/upgrade.md

@@ -0,0 +1,99 @@
+# Upgrade from IdentityServer4 to ForgePoint.Identity
+
+ForgePoint.Identity is a ForgePoint Labs Apache-2.0 continuation of IdentityServer4. APIs such as `AddIdentityServer()`, `IdentityServerOptions`, and `IdentityServerConstants` keep their type names. Package IDs and C# namespaces change.
+
+This project is not affiliated with or endorsed by Duende Software or the original IdentityServer4 authors.
+
+## 1. Swap NuGet packages
+
+| IdentityServer4 | ForgePoint.Identity |
+| --- | --- |
+| `IdentityServer4` | `ForgePoint.Identity` |
+| `IdentityServer4.Storage` | `ForgePoint.Identity.Storage` |
+| `IdentityServer4.EntityFramework` | `ForgePoint.Identity.EntityFramework` |
+| `IdentityServer4.EntityFramework.Storage` | `ForgePoint.Identity.EntityFramework.Storage` |
+| `IdentityServer4.AspNetIdentity` | `ForgePoint.Identity.AspNetIdentity` |
+
+```xml
+<PackageReference Include="ForgePoint.Identity" Version="10.0.0-*" />
+```
+
+If you previously restored a local 10.x build of these packages, delete the matching folders under `~/.nuget/packages` (they are lowercase, for example `forgepoint.identity`) so restore does not reuse an older nupkg with the same MinVer version.
+
+## 2. Rewrite namespaces
+
+| IdentityServer4 | ForgePoint.Identity |
+| --- | --- |
+| `IdentityServer4` | `ForgePoint.Identity` |
+| `IdentityServer4.Models` | `ForgePoint.Identity.Models` |
+| `IdentityServer4.Stores` | `ForgePoint.Identity.Stores` |
+| `IdentityServer4.EntityFramework` | `ForgePoint.Identity.EntityFramework` |
+| `IdentityServer4.AspNetIdentity` | `ForgePoint.Identity.AspNetIdentity` |
+
+```csharp
+using ForgePoint.Identity;
+using ForgePoint.Identity.Models;
+
+builder.Services.AddIdentityServer()
+    .AddInMemoryClients(clients)
+    .AddDeveloperSigningCredential();
+
+app.UseIdentityServer();
+```
+
+`AddIdentityServer()`, `UseIdentityServer()`, and `AddHealthChecks().AddIdentityServer()` stay the same and still live in `Microsoft.Extensions.DependencyInjection`.
+
+## 3. Run the upgrade script
+
+From a clone of this repository (or copy `scripts/upgrade-namespaces` into your app):
+
+```bash
+python3 scripts/upgrade-namespaces/rewrite.py /path/to/your/app --all --dry-run
+python3 scripts/upgrade-namespaces/rewrite.py /path/to/your/app --all
+```
+
+or
+
+```bash
+./scripts/upgrade-namespaces/upgrade.sh /path/to/your/app
+```
+
+```powershell
+./scripts/upgrade-namespaces/upgrade.ps1 -Path C:\path\to\your\app
+```
+
+`--all` updates:
+
+- `.cs`, `.cshtml`, `.razor` namespace and `using` directives
+- `.csproj` / `.props` / `.targets` `PackageReference`, `PackageVersion`, and `PackageId` values
+- EF Core snapshots and migrations that store CLR type names as `IdentityServer4.EntityFramework.Entities.*`
+
+The script does **not** rename:
+
+- `AddIdentityServer`, `UseIdentityServer`, `IdentityServerOptions`, `IdentityServerConstants`
+- `AssemblyName`, `RootNamespace`, `ProjectReference` paths, or `PackageTags`
+- `InternalsVisibleTo("IdentityServer4...")` friend-test assemblies
+
+Review the diff, then build.
+
+This script is for consuming apps. Do not run `--packages` against this repository: on-disk project file names stay `IdentityServer4*.csproj` even though the NuGet package ids are `ForgePoint.Identity*`.
+
+## 4. Entity Framework
+
+Table names (`Clients`, `PersistedGrants`, and so on) do not change. Existing databases do not need a schema migration for the namespace rename.
+
+Do run the script over your `Migrations` folder so snapshots use `ForgePoint.Identity.EntityFramework.Entities.*`. After that, do **not** add a new EF migration just for the rename — that would generate a noisy no-op or a false table rebuild.
+
+IdentityServer4 4.x databases still need the PAR column if you use pushed authorization:
+
+```sql
+ALTER TABLE [Clients] ADD [RequirePushedAuthorization] bit NOT NULL DEFAULT 0;
+```
+
+See `docs/migrations/add-require-pushed-authorization.sql`.
+
+## 5. What you should still do by hand
+
+- Authentication scheme strings such as `"IdentityServerAccessToken"` are unchanged
+- Signing keys, connection strings, and client configuration stay as they are
+- Host UI text that says “IdentityServer4” is cosmetic; the sample hosts in this repo already say ForgePoint.Identity

global.json

@@ -1,5 +1,7 @@
 {
   "sdk": {
-    "version": "3.1.402"
+    "version": "10.0.400",
+    "rollForward": "latestFeature",
+    "allowPrerelease": false
   }
-}
+}