6.5.0

Features

• Support for the SignedHttpRequest protocol has been added (#1260). See this wiki page for more information.

Bug Fixes

• Validator delegates are now called before checking if validation should occur (#1272).
• SecurityKey.InternalId and SignatureProvider caching logic has been changed (#1346).
• JWT segment counting bug in the JsonWebToken constructor has been fixed (#1299).
• Various documentation and code improvements have been made (#1186, #1342).

Target Changes

• netstandard1.4 has been removed (#1321).
• net451 desktop target has been removed (#1332).

Breaking changes from 5.6.0:

• The OpenIdConnectMessage(JObject json) constructor was removed and has been replaced with OpenIdConnectMessage(object json).
• TokenValidationResult has been moved from Microsoft.IdentityModel.JsonWebTokens to Microsoft.IdentityModel.Tokens.
• The JsonWebKeySet(string json, JsonSerializerSettings jsonSerializerSettings) constructor has been removed.

Click here for a full list of issues that were fixed in this release.

5.6.0

Features

• JWTs can now be created from both SecurityTokenDescriptor.Subject and SecurityTokenDescriptor.Claims (#1193).
• Added support for 'typ' header claim validation to JwtSecurityTokenHandler and JsonWebTokenHandler (#1220).
• Added support for creating unsigned JWTs in JsonWebTokenHandler (#1204).
• Added support for creating custom JWT header claims in JsonWebTokenHandler (#1210).
• Added support for creating a JWT with an empty payload in JsonWebTokenHandler (#1237).
• Added a setter for the AuthenticationProtocolMessage.Script property (#1193).

Bug Fixes

• The OpenIdConnectConfiguration.SigningKeys property is no longer used during JSON serialization and deserialization (#1242).
• RSACryptoServiceProviderProxy now properly disposes an RSA instance (#1240).
• DtdProcessing.Prohibit is now explicitly set when creating an XmlReader (#1258).
• JsonWebTokenHandler.CreateToken() now adds iat, nbf, and exp as longs not strings (#1207).
• DateTime claim processing is now corrected and consistent (#1261).
• Various improvements to the documentation.

Click here for a full list of issues that were fixed in this release.

5.5.0

Features

• SignatureProvider caching is turned ON by default.
• Added support for JWE decompression in JwtSecurityTokenHandler.
• Added support for RSA-PSS.
• Added support for reading and writing multiple signatures in XML envelopes.
• Saml(2)SecurityTokenHandlers can consume a token using an XmlReader.
• Improved support for converting JsonWebKey to SecurityKey for crypto operations.
• Support for ECDSA keys from JsonWebKeySet.
• Added GetClaim() and TryGetClaim() methods to JsonWebToken.
• Improved exception messages.

Build and Test

• Added performance and stress test framework.
• Published symbol packages to the NuGet.org symbol server, hence reducing size of main NuGet packages.
• Reduced the netstandard 2.0 dependency graph.

Bug Fixes

• Intermittent signature validation failures in multi-threaded environments when SignatureProvider caching is enabled.

Click here for a full list of issues that were fixed.

5.4.0

Features

Improvements to non-windows platforms

• RSACryptoServiceProviderProxy is only available on .Net Desktop.
• Support JsonWebKey.CreateECDsa on non-windows platforms.
• Created ECDsaAdapter to abstract differences between versions of .Net.
• Fixed IdentityModel build and test on Unix.
• Fixed signature validation on iOS that appears to have been introduced in 5.3.0.

Improvements to JsonWebToken and JsonWebTokenHandler

• Added TryGetValue methods in JsonWebToken.
• Public methods of JsonWebTokenHandler are now virtual.
• Added new API to JsonWebTokenHandler that takes a SecurityTokenDescriptor.
• SecurityTokenDescriptor.Claims property can be used to specify claims in JWT.

Continued removal of newtonsoft

Build and Test

• ApiCompatibility testing has been improved testing all platforms.

• Build scripts have been simplified

• Click here for a full list of issues that were fixed.

5.3.0

Features

• Introduced a new assembly which enables token signing and encryption operations via Azure Key Vault. This assembly enables authentication via Managed Service Identity, which means users don’t need to store secrets in the source code or any associated configuration files.
• Added .NET 4.6.1 and .NET Standard 2.0 targets.
• All asymmetric cryptography target specific logic is now abstracted into AsymmetricWrapper.
• Added JWE support to Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.
• Added a new abstract TokenHandler class that contains properties shared across all token handlers.
• Added support for JWEs containing a 'zip' (compression algorithm) header parameter to the JsonWebTokenHandler.
• Added a Property Bag to ease addition of custom TokenValidationParameters.
• Added in a X509EncryptingCredentials class to allow constructing EncryptingCredentials based on a X509 certificate, key wrap algorithm, and data encryption algorithm.
• See here for a full list of issues that were fixed.

Breaking Changes

• Removed any public references to JObject from Microsoft.IdentityModel.JsonWebTokens in order to distance the library from external dependencies.

Older Releases

• Older releases of IdentityModel Extensions for .NET are listed here.