One year and a half after releasing the first OpenIddict 3.0 alpha bits, I'm very pleased to announce that 3.0 is now generally available!
This release is unquestionably OpenIddict's most exciting milestone, as both the server and validation stacks were rewritten from scratch to adopt a whole new event-oriented model, which should give OpenIddict 3.0 much more flexibility and extensibility than the aspnet-contrib OpenID Connect server and validation middleware it replaces.
If you're interested in reading more about the changes introduced in this release, I wrote a few blog posts describing the most important ones:
- Creating an OpenID Connect server proxy with OpenIddict 3.0's degraded mode
- Adding OpenIddict 3.0 to an OWIN application
- Introducing OpenIddict 3.0 beta1
- OpenIddict 3.0 beta2 is out
- Introducing localization support in OpenIddict 3.0 beta3 (*note: localization support had to be removed in rc1 to keep the error descriptions returned by OpenIddict standard-compliant*)
- Introducing Quartz.NET support and new languages in OpenIddict 3.0 beta4
- Using the OrchardCore OpenID management feature with an existing OpenIddict deployment
- OpenIddict 3.0 beta6 is out
- Introducing OpenIddict 3.0's first release candidate version
In OpenIddict 3.0 RTM, the Data Protection formatter used to create and read tokens serialized using ASP.NET Core Data Protection was fixed to use the same serialization versions as OpenIddict 2.x so that tokens created with OpenIddict 2.x can be read and used with OpenIddict 3.0. This change will impact users of the beta and RC versions that opted in for the Data Protection format (typically, OrchardCore users). Fortunately, this only requires retrieving new refresh tokens by starting a new authorization flow.
As announced in Introducing OpenIddict 3.0 beta1, the OpenIddict 2.x and aspnet-contrib OpenID Connect server/validation middleware are now considered legacy/obsolete packages and won't receive bug fixes or security updates.
Whether you're still on ASP.NET 4.x (via OWIN/Katana), ASP.NET Core 2.1 on .NET Framework or .NET Core, ASP.NET Core 3.1 or are already using ASP.NET Core 5.0, migrating to OpenIddict 3.0 should never be a blocking factor, thanks to its broader-than-ever platforms support!
If you need additional time to migrate to OpenIddict 3.0 and are interesting in chatting about your options, feel free to ping me at contact@kevinchalet.com.
I'd like to thank Sébastien Ros, mridentity, Andrew, gustavdw, Gillardo, Dovydas Navickas and Christian Schmitt for sponsoring me on GitHub, which allows me to dedicate more time to OpenIddict! You guys have no idea how much I appreciate that.
Merry Christmas everyone!