IdentityServer Releases

Duende SoftwareCommunication & Messaging Tools.NET
Version v8.0.5 (Aug 10, 2026)

Learn what's new across releases, with details of features, enhancements, and resolved issues.

Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
IdentityServer v8.0.5Aug 10, 2026
Fixes
  • Fixed an InvalidCastException that could occur during server-side session cleanup. When a concurrent deletion caused a DbUpdateConcurrencyException in PersistedGrantStore.RemoveAllAsync, the affected entries were not detached from the EF Core change tracker. Those stale entries could then cause type mismatches in subsequent save operations. The fix ensures entries are properly detached after a concurrency exception.
IdentityServer v8.0.4Jul 28, 2026
Features
  • IDP-initiated SSO for SAML SP - When IdentityServer acts as a SAML Service Provider (via AddSamlServiceProvider() or dynamic SAML providers), it can now receive unsolicited authentication responses from upstream identity providers. Configure AllowUnsolicitedAuthnResponse = true and set IdpInitiatedCallbackUrl to your external login callback endpoint.
  • RelayState surfacing - The SAML RelayState value from IDP-initiated responses is now available in AuthenticationProperties.Items["relayState"], allowing your callback to use it for routing, tenant resolution, or other application logic.
  • Configurable RelayState size limit - MaxRelayStateLength (default 1024 bytes) controls the maximum size of RelayState that will be persisted in authentication properties, preventing cookie bloat from oversized values.
  • Breaking changes - SAML SP claim namespace changed: The internal claim type namespace used for SAML SP session correlation claims (SessionIndex, LogoutNameIdentifier) has changed. Users with active SAML SP sessions at the time of upgrade may experience failed single logout correlation until they re-authenticate. This only affects deployments using the SAML Service Provider feature (AddSamlServiceProvider() or dynamic SAML providers).
Fixes
  • Fixed misleading error messages in SAML SP unsolicited response handling.
  • The SAML SP handler now correctly populates the scheme property in AuthenticationProperties during IDP-initiated sign-in, ensuring compatibility with IdentityServer's external login callback pattern.
IdentityServer v8.0.3Jul 20, 2026
Fixes
  • Fixed nullable annotation on ITokenValidator.ValidateIdentityTokenAsync - the clientId parameter is now correctly annotated as nullable to match its intended usage.
  • Fixed Dynamic Client Registration to allow absolute_refresh_token_lifetime of 0, which represents no expiration.
IdentityServer v8.0.2Jun 16, 2026
Fixes
  • Fixed a license validation exception when using AddConfigurationStore without a license that includes the Dynamic Identity Providers feature. The EF configuration store registers an IIdentityProviderStore implementation, which incorrectly triggered a license check for Dynamic Identity Providers even when the feature was not in use.
IdentityServer v8.0.1Jun 11, 2026
Fixes
  • Fixed session duplication issue in IdentityServer 8.0 where concurrent requests could create duplicate server-side sessions.
  • Fixed nullable annotation on ITokenValidator.ValidateAccessTokenAsync - the expectedScope parameter is now correctly annotated as string? to match its intended usage.
Duende BFF Security Framework v4.2.0Jun 10, 2026
Features
  • You can now specify a custom IAccessTokenRetriever through YARP route or cluster metadata.
Fixes
  • Cookie name prefix constants (__Host-, __Secure-) now correctly include the trailing hyphen.
IdentityServer v8.0.0Major versionJun 2, 2026
Features
  • SAML 2.0 Identity Provider
    • IdentityServer can now act as a full SAML 2.0 Identity Provider, allowing enterprise and legacy applications that require SAML to authenticate against your server alongside OpenID Connect clients. It supports:
      • SP-initiated SSO via HTTP-Redirect and HTTP-POST bindings.
      • Single Logout (SLO) with front-channel notifications.
      • Per-SP assertion signing.
      • NameID format support.
      • AuthnContext class mapping, per-SP claim mappings.
      • Metadata endpoint.
    • Your existing login UI requires only a small update to the cancellation path.
  • SAML 2.0 External Authentication - IdentityServer can now federate with external SAML 2.0 Identity Providers, letting you use a third-party SAML IdP as an upstream identity source - the same way you'd add Google or Microsoft Entra ID as an external provider. Configure SAML external providers statically or dynamically using the existing dynamic providers mechanism.
  • Financial-Grade Security & Conformance Report - A new Duende.IdentityServer.ConformanceReport package assesses your IdentityServer deployment against OAuth 2.1 and FAPI 2.0 Security Profile specifications and generates an HTML report at a protected endpoint (/_duende/conformance-report). Use it to verify your server is correctly configured for high-security API scenarios.
  • User Management - IdentityServer now integrates with Duende User Management which adds user registration, password management, MFA (TOTP, passkeys), account recovery, and more.
  • Token Cleanup Performance - The token cleanup service now uses a more efficient bulk delete strategy when IOperationalStoreNotification is not registered, reducing database load in high-throughput deployments. MySQL EF Core provider compatibility for PAR entry cleanup is also restored.
  • Orphaned Grants Revoked on Session Overwrite - When a server-side session is overwritten (for example, when a user signs in again without signing out first), refresh tokens belonging to the prior session are now automatically revoked. This prevents stale grants from accumulating and remaining valid after re-authentication.
  • Quieter Secret Validation Logging - Expected-failure log entries in client and API secret validation have been downgraded from Error to Debug. This reduces noise in production logs where failed secret lookups are a normal part of the secret hashing comparison process.
  • Relaxed Audience Validation - Audience validation for private key JWT authentication in strict mode now accepts single-element JSON arrays in addition to scalar string values, improving compatibility with tokens from issuers that always serialize audiences as arrays.
  • HTTP 303 Redirects - All redirects from IdentityServer's authorization endpoint now unconditionally use HTTP 303 See Other, aligning with the OAuth 2.0 and OpenID Connect specifications and avoiding issues with intermediaries that treat 302 redirects differently.
  • Unified Authorization Context - SAML and OpenID Connect flows now share the same IAuthenticationContext abstraction. Your login page can access protocol-specific context - including SAML-specific details such as RequestedAuthnContext - through a single consistent interface.
  • License Key from IConfiguration - The IdentityServer license key can now be provided through standard .NET configuration sources such as appsettings.json, environment variables, or a secrets manager, making deployment configuration simpler and more consistent with other .NET settings.
  • AuthorizeInteractionPageHttpWriter Now Public - The AuthorizeInteractionPageHttpWriter class is now part of the public API, giving you full control over how IdentityServer writes authorization interaction responses without relying on internal implementation details.
Fixes
  • Backchannel Logout Fix - Resolved an issue where backchannel logout notifications could be sent twice for the same session.
Duende BFF Security Framework v4.1.2Mar 13, 2026
Features
  • Updated Duende.IdentityModel dependency to 8.0.1.
IdentityServer v7.4.7Mar 13, 2026
Features
  • Updated Duende.IdentityModel dependency to 8.0.1.
Duende BFF Security Framework v4.1.1Feb 18, 2026
Fixes
  • Fixed an issue where BFF will crash when openid connect options are retrieved outside of HTTP Request context.
  • Fixed an issue with Stackoverflow when BFF is explicitly configured with Authentication schemes, but without ForbidScheme.
IdentityServer v7.4.6Feb 12, 2026
Fixes
  • Made ServerSideSessionCleanupHost.StopAsync idempotent (prevent exceptions if it is called multiple times).
  • Do not escape '+' character in x5c of jwks.
Duende BFF Security Framework v4.0.3Jan 29, 2026
Fixes
  • Fixed issue where yarp proxying doesn't calculate htu correctly.
Duende BFF Security Framework v4.1.0Jan 29, 2026
Features
  • Introduced new extensibility point to enrich the claims from the user endpoint.
IdentityServer v7.4.5Jan 22, 2026
Fixes
  • Fixed a regression where the '+' character was not treated as a space in query params.
Duende BFF Security Framework v4.0.2Jan 13, 2026
Fixes
  • Fixed nullability issues with ClaimRecord and ClaimsPrincipalRecord.