Skip to content

Upgrade Duende IdentityServer to 8.0.9 - #563

Merged
elinohlsson merged 1 commit into
mainfrom
feature/upgrade-identity-server
Oct 9, 2026
Merged

elinohlsson merged 1 commit into
mainfrom
feature/upgrade-identity-server

Conversation

@elinohlsson

@elinohlsson elinohlsson commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Upgrade Duende IdentityServer to v8.0.9

Summary

Upgrades Duende.IdentityServer in the IdentityServer.ServerSample project from 7.4.5 to 8.0.9. I went through the v8 upgrade guide step by step and checked each item against the codebase.

Changes

  • IdentityServer.ServerSample.csproj: bumped Duende.IdentityServer from 7.4.5 to 8.0.9.
  • AccountController.cs: GetLogoutContextAsync now receives HttpContext.RequestAborted. v8 requires a CancellationToken on all async store and service interface methods.

Upgrade guide review

No other changes were needed. The sample only uses IIdentityServerInteractionService (GetLogoutContextAsync, IsValidReturnUrl), in-memory clients and identity resources, and a developer signing credential. Searches of the code and settings found none of the affected APIs or features, including:

  • Entity Framework stores, migrations, and the IClientStore and IResourceStore interfaces
  • ICache<T> / IClock / ICancellationTokenProvider
  • ITokenValidator and IRefreshTokenService
  • IUserSession, IProfileService, AuthorizationError, DPoP and JwtBearer
  • IAuthorizationParametersMessageStore, licensing types, options.Preview and SAML

Behavioral notes

  • IdentityServer now always uses HTTP 303 for redirects from POST endpoints. Nothing in the sample depends on 302.
  • No license key is configured, so the sample still runs in unlicensed (development) mode.

Verification

  • IdentityServer.ServerSample builds successfully against 8.0.9.
  • I have runned the sample end to end.

Testing suggestions

  • Run the sample and complete a login and logout flow, including the post-logout redirect.
  • Check that the external login callback still redirects correctly.

- Bump Duende.IdentityServer from 7.4.5 to 8.0.9 in IdentityServer.ServerSample
- Pass HttpContext.RequestAborted to IIdentityServerInteractionService.GetLogoutContextAsync
  in AccountController, as v8 requires a CancellationToken on async interface methods

No other breaking changes from the v8 upgrade guide affect the sample.
@elinohlsson
elinohlsson marked this pull request as ready for review October 9, 2026 12:42
@elinohlsson
elinohlsson requested a balanced review from Copilot October 9, 2026 12:42

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The package is compatible with the sample’s target framework, and the required API migration is correctly implemented.

0 open findings

What changed in this PR

Upgrades the IdentityServer sample to Duende IdentityServer 8.0.9 and adapts logout handling to its cancellation-token API.

Changes:

  • Updated the Duende IdentityServer dependency.
  • Propagated request cancellation during logout-context retrieval.
File Description
IdentityServer.ServerSample.csproj Upgrades Duende IdentityServer to 8.0.9.
AccountController.cs Passes RequestAborted to the logout API.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@elinohlsson
elinohlsson merged commit b173b31 into main Oct 9, 2026
17 checks passed
@elinohlsson
elinohlsson deleted the feature/upgrade-identity-server branch October 9, 2026 12:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants