New release: IdentityServer 7.3

[maartenba]

Duende IdentityServer 7.3.0 has been published on NuGet!

• Release notes
• Upgrade guide

IdentityServer 7.3 is a significant release that includes:

• FAPI 2.0 profile certification
• JWT Response from the introspection endpoint (RFC 9701)
• Diagnostic data
• Removal of the experimental label from OpenTelemetry metrics
• Additional license compliance warnings
• Several bug fixes
• Numerous small code quality and performance enhancements from the community

We invite you all to our livestream on August 21, 2025, to see @josephdecock present what's new! Register here: https://duendesoftware.com/webinars/duende-identityserver-7-3-fapi-2-0

[CaringDev]

Due to Additional license compliance warnings (presumably) I now get The property or field 'ClientId' on type 'Duende.IdentityServer.Models.Client' doesn't allow getting null values on startup.
All my clients (including ClientIds) are configured by code (AddInMemoryClients).

Unhandled exception. System.Text.Json.JsonException: The property or field 'ClientId' on type 'Duende.IdentityServer.Models.Client' doesn't allow getting null values. Consider updating its nullability annotation. Path: $.ClientId.
   at System.Text.Json.ThrowHelper.ThrowJsonException_PropertyGetterDisallowNull(String propertyName, Type declaringType)
   at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.WriteCore(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonTypeInfo`1.Serialize(Utf8JsonWriter writer, T& rootValue, Object rootValueBoxed)
   at System.Text.Json.JsonSerializer.WriteDocument[TValue](TValue& value, JsonTypeInfo`1 jsonTypeInfo)
   at System.Text.Json.JsonSerializer.SerializeToDocument[TValue](TValue value, JsonSerializerOptions options)
   at Duende.IdentityServer.Licensing.V2.Diagnostics.ClientLoadedTracker..ctor() in /_/identity-server/src/IdentityServer/Licensing/V2/Diagnostics/ClientLoadedTracker.cs:line 29
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
   at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitIEnumerable(IEnumerableCallSite enumerableCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.DynamicServiceProviderEngine.<>c__DisplayClass2_0.<RealizeService>b__0(ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(ServiceIdentifier serviceIdentifier, ServiceProviderEngineScope serviceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngineScope.GetService(Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider)
   at Microsoft.Extensions.DependencyInjection.IdentityServerBuilderExtensionsCore.<>c.<AddCoreServices>b__7_1(IServiceProvider serviceProvider) in /_/identity-server/src/IdentityServer/Configuration/DependencyInjection/BuilderExtensions/Core.cs:line 231
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitIEnumerable(IEnumerableCallSite enumerableCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.CreateServiceAccessor(ServiceIdentifier serviceIdentifier)
   at System.Collections.Concurrent.ConcurrentDictionary`2.GetOrAdd(TKey key, Func`2 valueFactory)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(ServiceIdentifier serviceIdentifier, ServiceProviderEngineScope serviceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider)
   at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at My.Program.<Main>(String[] args)

[josephdecock]

Thanks very much for the bug report. We will obviously be investigating this immediately.

From the stack trace I can see this is coming out of the new code that records which clients have been used in the new diagnostic logs.

Somehow the serialization of your client models is failing to find a client id.

[josephdecock]

I've done some more investigation, and I believe this is likely caused by a new feature added to System.Text.Json in the .NET 9 release: the RespectNullableAnnotations option. @CaringDev can you please check to see if you have set the global System.Text.Json.Serialization.RespectNullableAnnotationsDefault flag, and if so does turning it off work around this issue?

[CaringDev]

@josephdecock thank you for the quick response! Indeed, I have RespectNullableAnnotations = true. I'll check whether disabling this mitigates the problem and will get back to you by Monday afternoon (I'm already OoO and do not have write-access to the code).

[josephdecock]

Thanks! As I mentioned elsewhere in this discussion, I've published 7.3.1 which should allow you to enable RespectNullableAnnotations. Cheers!

[ESPNSTI]

The LicenseExpirationChecker causes an Unknown license feature exception if the license has the unlimited_clients feature.

System.ArgumentException
  HResult=0x80070057
  Message=Unknown license feature {feature} (Parameter 'unlimited_clients')
  Source=Duende.IdentityServer
  StackTrace:
   at Duende.IdentityServer.Licensing.V2.License.ToFeatureEnum(String claimValue) in /_/identity-server/src/IdentityServer/Licensing/V2/License.cs:line 223
   at Duende.IdentityServer.Licensing.V2.License.get_AllowedFeatureMask() in /_/identity-server/src/IdentityServer/Licensing/V2/License.cs:line 201
   at Duende.IdentityServer.Licensing.V2.License.IsEnabled(LicenseFeature feature) in /_/identity-server/src/IdentityServer/Licensing/V2/License.cs:line 188
   at Duende.IdentityServer.Licensing.V2.License.get_Redistribution() in /_/identity-server/src/IdentityServer/Licensing/V2/License.cs:line 147
   at Duende.IdentityServer.Licensing.V2.LicenseExpirationChecker.CheckExpiration() in /_/identity-server/src/IdentityServer/Licensing/V2/LicenseExpirationChecker.cs:line 21
   at Microsoft.AspNetCore.Builder.IdentityServerApplicationBuilderExtensions.Validate(IApplicationBuilder app) in /_/identity-server/src/IdentityServer/Configuration/IdentityServerApplicationBuilderExtensions.cs:line 83
   at Microsoft.AspNetCore.Builder.IdentityServerApplicationBuilderExtensions.UseIdentityServer(IApplicationBuilder app, IdentityServerMiddlewareOptions options) in /_/identity-server/src/IdentityServer/Configuration/IdentityServerApplicationBuilderExtensions.cs:line 37

I imagine a similar error will happen if a license has the unlimited_issuers feature.

[josephdecock]

Thanks very much for the bug report. I am investigating right now and we will keep you updated.

[josephdecock]

We've got a fix in progress for this issue.

[josephdecock]

The fix is now published on NuGet as part of IdentityServer 7.3.1. Cheers!

[josephdecock]

Thanks to our great community for trying out the newest release! There were a couple of issues reported in this thread which have been addressed, and now an updated build - IdentityServer 7.3.1 - has been published.

7.3.1 fixes a bug where uncommon license configurations could cause an exception and adds support for RespectNullableAnnotationsDefault in System.Text.Json. Thanks again everyone!

[josephdecock]

Release notes: https://github.com/DuendeSoftware/products/releases/tag/is-7.3.1
NuGet: https://www.nuget.org/packages/Duende.IdentityServer/7.3.1