3.1.0
3.1.0
- Updated to Microsoft.IdentityModel.* 8.0.2
Security improvement:
- Id Web now uses
CaseSensitiveClaimsIdentity
by default and provides AppContextSwitches to fallback to usingClaimsIdentity
. This means that when you loopup claims with FindFirst(), FindAll() and HasClaim(), you need to provide the right casing for the claim. See PR #2977 for details.
Bug fixes:
- For SN/I scenarios, Id Web's
GetTokenAcquirer
now setsSendX5C
in particular protocols. See issue #2887 for details. - Fix for Instance/Tenant parsing for V2 authority (affected one Entra External IDs scenario). See PR #2954 for details.
- Fix regex that threw a format exception:
The input string " was not in a correct format
when enabling same-site cookie compatibility with userAgent: "Dalvik/2.1.0 (Linux; U; Android 12; Chromecast Build/STTE.230319.008.H1). See issue #2879 for details. - Microsoft.Identity.Web 3.1.0 now has an upper bound set on its dependency on Microsoft.Identity.Abstractions to version 7x to avoid referencing Microsoft.Identity.Abstractions 8.0.0, which has an interface breaking change, not yet implemented in Microsoft.Identity.Web. See PR #2962 for details.
Fundamentals:
- Fix flakey tests: #2972, #2984, #2982,
- Update to
AzureKeyVault@2
in AzureDevOps, #2981. - Update to .NET 9-preview7, #2980 and #2991.
- It's now possible to build a specific version of Microsoft.Identity.Web based on specific versions of Microsoft.IdentityModel and Microsoft.Identity.Abstractions by specifying build variables on the dotnet pack command (MicrosoftIdentityModelVersion, MicrosoftIdentityAbstractionsVersions, and MicrosoftIdentityWebVersion): #2974, #2990
What's Changed
- Add X5C to MSAuth POP by @bgavrilMS in #2950
- Update CSPROJ with README by @localden in #2956
- Fix Instance/Tenant Parsing for V2 Authority by @jackj-msft in #2954
- Check that regex succeeded and value is an integer. by @brentschmaltz in #2958
- Set upper bound on Abstractions by @westin-m in #2962
- Removing 2.x versions post 3.0.0-preview1 by @JoshLozensky in #2967
- Fix test instability by @keegan-caruso in #2971
- Fix AT POP tests by @keegan-caruso in #2972
- Update to net 9 preview 7 by @westin-m in #2980
- Updating AzureKeyVault task to version 2 by @JoshLozensky in #2981
- [test] updates for one build by @jennyf19 in #2974
- Disable ciam test by @keegan-caruso in #2983
- Ensure that SimulateOidc is built before IntegrationTests (that use it) by @jmprieur in #2984
- skip more CIAM E2E tests by @jennyf19 in #2985
- remove grpc in E2E test by @jennyf19 in #2986
- Jennyf/fix slice by @jennyf19 in #2988
- reenable other ciam test by @jennyf19 in #2989
- Jennyf/client sem ver by @jennyf19 in #2990
- Fix Id Web Build by @FuPingFranco in #2991
- Add BannedApiAnalyzers to prevent use of ClaimsIdentity constructors and AppContextSwitches for fallback by @pmaytak in #2977
New Contributors
- @localden made their first contribution in #2956
- @jackj-msft made their first contribution in #2954
Full Changelog: 3.0.1...3.1.0