7.0.0 beta 1

Many breaking changes

A migration guide will be produced while the beta runs and made available before GA. The summary is:

• Authentication SDK includes all-new ID Token Validation which will now validate H256.

  • If your app is configured for HS256 and is confidential such as a web server then you will need to set SigningAlgorithm to SigningAlgorithm.HS256 on your AuthenticationApiClient requests.
  • If your app is configured for HS256 and is NOT confidential such as a native client you should reconfigure your app for RS256 as soon as possible.
  • If your app is configured for RS256 no changes are required. JWKS caches are now only valid for 10 minutes and will not cache the JWKS keys indefinitely.

• Improved testing and mocking support. You can now mock IAuthenticationConnection / IManagementConnection classes to provide local unit-testing functionality for AuthenticationApiClient and ManagementApiClient respectively. Each has just two methods that can be mocked - one for GET and one for other HTTP verbs.

• Many classes moved namespace especially ones that were in Core as part of the long-term plan to only have AuthenticationApi and ManagementApi packages. Visual Studio should be able to suggest where classes you were using now reside.

• Disposal is now more consistent. If AuthenticationApiClient or ManagementApiClient create a connection for you they will manage its lifecycle. If you pass in a connection then it will be your responsibility to manage it. This also applies to how HttpClientAuthenticationConnection and HttpClientManagementConnection will only dispose of a HttpClient they create and not ones they are given.

• Rate Limiting information is now only available on the RateLimitApiException which is raised when the rate limit is exceeded.

• ApiException is now ErrorApiException. If you use the status code or error message on exception you will need to switch to catching the later. The former is now a base class that does not have this information but ensures any old catch ApiException will continue to catch rate limit exceptions which also now inherit from this class.

• Microsoft recommends HttpClient is reused as much as possible. Therefore you should use dependency injection or inversion of control to ensure that either a single instance of AuthenticationApiClient / ManagementApiClient or its connections HttpClientXConnection are created to ensure sharing. These classes are now thread-safe. You can additionally share HttpClient objects between them if you wish by injecting it into the HttpClientXConnection constructor.

6.5.5

• Signup API result now handles custom databases returning variations of "id" name #304
• Fix EnrollmentAuthMethod.Authenticator enum name #322
• ClientBase now has property for initiate_login_uri #307

6.5.4

• SECURITY FIX for CVE-2019-16929

6.5.3

WARNING: If you generate tokens in your project via System.IdentityModel.Tokens.Jwt please read this important notice.

• Upgraded System.IdentityModel.Tokens.Jwt to 5.5 to fix incompatible kid #293
• Upgraded Microsoft.IdentityModel.Protocols.OpenIdConnect to 5.5
• Add ClientId to VerifyEmailJobRequest #292
• Updated all test dependencies (xunit, FluentAssertions, .NET Test SDK)
• Removed unused Console Workbench project

6.5.2

• UserClient.GetEnrollments now correctly passes user id.

6.5.1

• User and role permissions endpoints in UsersClient and RolesClient paging fix.

6.5.0

• Assembly is now strong-name-signed so it can be used by other strong-name-signed packages #207
• User & role permissions endpoints in UsersClient and RolesClient now correctly page #284 #282
• User model optional fields (CreatedAt, UpdatedAt, LastLogin) are now nullable #276

Note: This is code signing only using a non-secret key. It is not authenticode or tamper protection.

v6.4.0

• TenantSettings lifetimes are now double not integer.
• Added various Guardian-related endpoints on UserClient.

v6.3.0

• Missing Tenant settings now available (device flow, Guardian MFA, Change Password, flags etc.

v6.2.0

• Added client_id to GetDeviceCredentials response #265
• Added various user properties to UserUpdateRequest #263