Bump Duende.IdentityServer and Duende.IdentityServer.EntityFramework

[dependabot]

Bumps Duende.IdentityServer and Duende.IdentityServer.EntityFramework. These dependencies needed to be updated together.
Updates Duende.IdentityServer from 7.2.0 to 7.2.3

Release notes

Sourced from Duende.IdentityServer's releases.

IdentityServer 7.2.3

This is a patch release that fixes a regression where multiple WWW-authenticate headers where issued.

What's Changed

• Ensure WWW-Authenticate uses a single HTTP header by @​khalidabuhakmeh in DuendeSoftware/products#1998

Full Changelog: DuendeSoftware/products@is-7.2.2...is-7.2.3

IdentityServer 7.2.2

This is a patch release that

• Hardens the default configuration of the sensitive values filters and
• Fixes mTLS binding so that port numbers can be used as part of mTLS domain

Sensitive Values Filter Defaults

hardens the security of the default configuration that controls the redaction in logs of parameters passed to the Pushed Authorization (PAR) and Authorize endpoint, ensuring that client secrets and client assertions are not logged by default.

In particular, the default value of AuthorizeRequestSensitiveValuesFilter and PushedAuthorizationSensitiveValuesFilter have been changed to both be ["client_secret", "client_assertion", "id_token_hint"].

PAR requests sometimes are handled by the same code path as authorize requests, so this makes both filters the same by default.

mTLS port number

The MtlsOptions.DomainName can now include a port number.

Detailed Changelog

• Harden default logging filters for PAR and Authorize endpoints (7.2) by @​josephdecock in DuendeSoftware/products#1978
• Respect port number in mTLS configuration by @​josephdecock in DuendeSoftware/products#1990

Full Changelog: DuendeSoftware/products@is-7.2.1...is-7.2.2

IdentityServer 7.2.1

This is a patch release of IdentityServer that fixes a bug where a private_key_jwt client authentication token would be rejected if it had no typ header, even if strict validation of such tokens was not enabled.

What's Changed

• Handle no typ in private_key_jwt authentication by @​josephdecock in DuendeSoftware/products#1965

Commits

• 97927d9 Merge pull request #1998 from DuendeSoftware/ka-fix-WWWAuthenticate
• ddd59d5 Use shouldly in new ProtectedResourceError tests
• a960bf4 Add Shoudly in identity-server test projects
• 8d23356 Add vscode settings to .gitignore
• 9f1fa1a Add unit tests and refactor ProtectedResourceErrorResult
• 3f84936 Merge pull request #2001 from DuendeSoftware/7.2-minver
• 1fda5d9 Merge branch 'releases/is/7.1.x' into 7.2-minver
• 739f79a Merge pull request #2000 from DuendeSoftware/7.1-minver-fix
• c094711 Merge 7.0.x forward to 7.1.x
• 871d8b5 Merge pull request #1999 from DuendeSoftware/jmdc/minver
• Additional commits viewable in compare view

Updates Duende.IdentityServer.EntityFramework from 7.1.1 to 7.2.3

Release notes

Sourced from Duende.IdentityServer.EntityFramework's releases.

IdentityServer 7.2.3

This is a patch release that fixes a regression where multiple WWW-authenticate headers where issued.

What's Changed

• Ensure WWW-Authenticate uses a single HTTP header by @​khalidabuhakmeh in DuendeSoftware/products#1998

Full Changelog: DuendeSoftware/products@is-7.2.2...is-7.2.3

IdentityServer 7.2.2

This is a patch release that

• Hardens the default configuration of the sensitive values filters and
• Fixes mTLS binding so that port numbers can be used as part of mTLS domain

Sensitive Values Filter Defaults

hardens the security of the default configuration that controls the redaction in logs of parameters passed to the Pushed Authorization (PAR) and Authorize endpoint, ensuring that client secrets and client assertions are not logged by default.

In particular, the default value of AuthorizeRequestSensitiveValuesFilter and PushedAuthorizationSensitiveValuesFilter have been changed to both be ["client_secret", "client_assertion", "id_token_hint"].

PAR requests sometimes are handled by the same code path as authorize requests, so this makes both filters the same by default.

mTLS port number

The MtlsOptions.DomainName can now include a port number.

Detailed Changelog

• Harden default logging filters for PAR and Authorize endpoints (7.2) by @​josephdecock in DuendeSoftware/products#1978
• Respect port number in mTLS configuration by @​josephdecock in DuendeSoftware/products#1990

Full Changelog: DuendeSoftware/products@is-7.2.1...is-7.2.2

IdentityServer 7.2.1

This is a patch release of IdentityServer that fixes a bug where a private_key_jwt client authentication token would be rejected if it had no typ header, even if strict validation of such tokens was not enabled.

What's Changed

• Handle no typ in private_key_jwt authentication by @​josephdecock in DuendeSoftware/products#1965

IdentityServer 7.2.0

IdentityServer 7.2 is a significant release that includes:

• Optional strict validation of private_key_jwt audiences, implementing RFC 7523 bis
• Optional caching of the discovery endpoint
• Less log noise when issuing the use_dpop_nonce response from the token endpoint
• Bug fixes and optimizations

Upgrading

There are no breaking changes or schema updates required to upgrade from IdentityServer 7.1 to 7.2.

Upgrading from IdentityServer 7.2.0-preview.1

We have moved the StrictClientAssertionAudienceValidation option that was introduced in 7.2.0-preview.1 into a new Preview section of the options. This new section provides a mechanism for us to deliver new features more quickly, and gives us the flexibility to change implementation details, behavior, or the API surface. Users can opt in to preview features at their own discretion, with the understanding that we make a stronger commitment to API stability once a feature leaves preview. Our intent with Preview flags is to be able to iterate quickly while still providing stability.

... (truncated)

Commits

• 97927d9 Merge pull request #1998 from DuendeSoftware/ka-fix-WWWAuthenticate
• ddd59d5 Use shouldly in new ProtectedResourceError tests
• a960bf4 Add Shoudly in identity-server test projects
• 8d23356 Add vscode settings to .gitignore
• 9f1fa1a Add unit tests and refactor ProtectedResourceErrorResult
• 3f84936 Merge pull request #2001 from DuendeSoftware/7.2-minver
• 1fda5d9 Merge branch 'releases/is/7.1.x' into 7.2-minver
• 739f79a Merge pull request #2000 from DuendeSoftware/7.1-minver-fix
• c094711 Merge 7.0.x forward to 7.1.x
• 871d8b5 Merge pull request #1999 from DuendeSoftware/jmdc/minver
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.