Skip to content

develop merge#42

Merged
JoeShook merged 32 commits into
udap-tools:mainfrom
JoeShook:main
Jul 20, 2026
Merged

develop merge#42
JoeShook merged 32 commits into
udap-tools:mainfrom
JoeShook:main

Conversation

@JoeShook

Copy link
Copy Markdown
Collaborator

This pull request introduces several important updates across dependency management, feature enhancements, and documentation improvements. The main highlights are the upgrade to Duende IdentityServer 8.x, support for a new "community" claim in access tokens, and the removal of the Sigil (now Sigyll) PKI management tool from the repository. Additionally, there are updates to TEFCA extension naming and documentation to reflect recent standards changes.

Dependency and Compatibility Updates:

  • Upgraded all Duende.IdentityServer and related packages (including Duende.IdentityServer.Storage, Duende.IdentityServer.EntityFramework.Storage, and Duende.IdentityServer.AspNetIdentity) from version 7.4.7 to 8.0.2 in both Directory.Packages.props and Udap.Server.Storage/Udap.Server.Storage.csproj. Updated conditional package references to unconditional for .NET 10.0 only. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156L10-R10), [[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156L26-R28), [[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156L52-R52), [[4]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-bdd864c61752cd55b1719e51ebc32a2f29a594f928fe17273fe3b6af25767358L24-R28), [[5]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-bdd864c61752cd55b1719e51ebc32a2f29a594f928fe17273fe3b6af25767358L4-R4))
  • Updated .config/dotnet-tools.json to use dotnet-ef version 10.0.9 and added the rollForward property. ([.config/dotnet-tools.jsonL6-R10](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-7afd3bcf0d0c06d6f87c451ef06b321beef770ece4299b3230bb280470ada2f6L6-R10))

Feature Additions and Enhancements:

  • Added support for surfacing the client's community in two ways: a new community property on the client and a udap_community claim in access tokens, controlled by the new ServerSettings.IncludeCommunityClaim option. Constants and documentation were updated accordingly. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b1241229fcfe143330957523056d5f9634e598e0419f572fbdeca2626e79db7eR95-R104), [[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-fff32d406f9cda3773001ac9bb118cfabcb58e839165ae8b166272a494ed9e48R213-R218), [[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-a4d509d0c36ae5ee6e8ff4ab00228cd134a68fd36fadff1aeee6011b74b5c8a0R26))
  • Extended the IUdapClientRegistrationStore and its implementation to support lookup of tiered clients by IdP base URL, which is now used in tiered OAuth challenges. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-8d5aa57d61fe52989121e7d378f9c05b8c21b0f74a85d586447783e84e0c3797R36-R43), [[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b01c6a86942dfe04981f1e680aff04a25bebc3806479ac9c2fcf97f160a3b403L167-R176))

Project Structure and Build:

  • Removed all Sigil PKI management tool projects from the repository and build process, reflecting the migration to the new Sigyll repository. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b1a9e11b184ddf93715fab5ae64a5857e7ded352fc53d85f42904b7e71a295ffL65-L74), [[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b1a9e11b184ddf93715fab5ae64a5857e7ded352fc53d85f42904b7e71a295ffL90), [[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-6ebdb617a8104a7756d0cf36578ab01103dc9f07e4dc6feb751296b9c402faf7L116-R143))
  • Updated Udap.Server/Hosting/DynamicProviders/Store/UdapInMemoryIdentityProviderStore.cs to require a cancellation token for its async methods and clarified return types. ([Udap.Server/Hosting/DynamicProviders/Store/UdapInMemoryIdentityProviderStore.csL24-R38](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-50a5d8dc1f45795d2c407bfb24a2c109fe65eff037484e02b62bb77342ce0165L24-R38))

TEFCA and Extension Naming Consistency:

  • Renamed the TEFCA IAS extension from tefca-ias to tefca_ias throughout the codebase and documentation for consistency with the latest standards. Updated references in extension models, metadata, and interface documentation. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L75-R79), [[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L88-R93), [[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L117-R118), [[4]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-dbe50335d3441ace231976cbb21a32414ac5b9ffa84845cc4cd4084aa6ca65a8L95-R95), [[5]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-7c4b43b994eac4c659719f37907a4a4ed3395e53dd90d462edf0721d164de8f9L15-R20), [[6]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-2328aaab2aec678e8c9d44d9283d355a875f19aea992e7f0d1a10c02a6104827L15-R15))

Documentation Improvements:

  • Updated documentation to reflect the increase from 12 to 17 TEFCA Exchange Purpose (XP) codes (SOP v5.1), added new feature descriptions, and clarified known issues with FHIR package caching and test project dependencies. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L75-R79), [[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L88-R93), [[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-6ebdb617a8104a7756d0cf36578ab01103dc9f07e4dc6feb751296b9c402faf7R56-R82))

These changes collectively improve standards compliance, add new features for community identification, and streamline the repository by removing deprecated components.

Expose matched trust anchor from ValidateResource

  • TrustChainValidationResult.MatchedAnchor tells you the specific anchor the metadata chained to — the root the chain actually terminated at — plus its CommunityId/CommunityName.

dependabot Bot and others added 30 commits May 18, 2026 22:36
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.0 to 10.0.300.
- [Release notes](https://github.com/dotnet/sdk/releases)
- [Commits](https://github.com/dotnet/sdk/commits/v10.0.300)

---
updated-dependencies:
- dependency-name: dotnet-sdk
  dependency-version: 10.0.300
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Udap.Client minor updates and continued work on the Sigil CA tool.
Scaffolds Sigil.Did and Sigil.Vc projects so DID/VC business logic and its
NuGet deps (SimpleBase, JsonSchema.Net, Microsoft.IdentityModel.Tokens 8+)
stay isolated from X.509 code. Entity POCOs stay in Sigil.Common to keep
SigilDbContext single without circular project references.

Adds 5 entities (DidTemplate, DidDocument, VerificationMethod,
CredentialSchema, IssuedCredential) plus migration AddDidAndVcEntities.
TrustDomain gains DidDocuments + IssuedCredentials collections.

Extends ISigningProvider with GetRawPublicKeyAsync (needed for did:key
multicodec encoding) and Ed25519 in LocalSigningProvider via BouncyCastle.
Vault and GCP providers stub Ed25519 with NotSupportedException pending
Phase C wiring.

Sets up Phase A (did:key) + Phase D (JWT-VC). Services, DI, UI, and tests
land in subsequent commits.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
DID + VC services
- Sigil.Did: DidTemplateService, DidIssuanceService, DidKeyMethodProvider
  (did:key with Ed25519 + multibase), DidDocumentBuilder, IDidMethodProvider
- Sigil.Vc: CredentialSchemaService, CredentialIssuanceService,
  CredentialVerifier, CredentialJwtBuilder
- Program.cs: register DID/VC services and seed did:key preset template
  + MemberCredential schema; project refs from Sigil, Sigil.UI, tests
- 4 new test files covering DID issuance, did:key minting, credential
  issuance, and credential verification

UI pages
- Dids, DidTemplates, Credentials, CredentialSchemas pages with
  Class="multiline-text" on long-value columns and Wrap="true" on
  Actions stacks so buttons flow instead of overlapping

FluentDataGrid UX fixes (all grids)
- sigilFreezeResizableGrids JS helper in App.razor invoked from
  MainLayout.OnAfterRenderAsync: walks each fluent-data-grid with
  ResizableColumns and rewrites GridTemplateColumns from minmax/fr/auto
  to fixed pixel widths, matching what Fluent does internally on first
  drag. Resize handles now grab from first render.
- Restored Fluent's 16px horizontal cell padding (site.css had been
  overriding it to 0); rows no longer touch adjacent column text
- Wrap="true" added to Actions FluentStacks in TrustDomains, SanLists,
  Dids, Credentials, DidTemplates, CredentialSchemas

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Introduce ServerSettings.IncludeCommunityClaim (default false). When
enabled, registration writes the community name to the client's
community property, and token issuance adds a udap_community claim to
access tokens on both client_credentials and authorization_code flows.
The claim value is resolved from the stored community id at token time
so a later community rename is reflected automatically.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Explain the param-name-as-org encoding, the aud/POST-URL source, the
DefaultOrgMap "empty" default, and registration-only scope. Add guidance
on choosing one shared client_id (same org=data_holder key, one scope set)
vs. separate client_ids (different key, independent scopes) across endpoints.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…umentation-for-ai-tone

# Conflicts:
#	Udap.Server/docs/README.md
…r-ai-tone

Refine Udap.Server docs tone and copy accuracy
…otnet-sdk-10.0.300

Bump dotnet-sdk from 10.0.0 to 10.0.300
Sigil (examples/CA) was renamed to Sigyll and moved to its own repository
at https://github.com/JoeShook/Sigyll with full git history preserved.

- Remove all Sigil project files from examples/CA
- Remove the 11 Sigil project entries from Udap.sln
- Keep examples/CA as a pointer (README.md -> Sigyll repo)
- Update CLAUDE.md example-projects list

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.300 to 10.0.301.
- [Release notes](https://github.com/dotnet/sdk/releases)
- [Commits](dotnet/sdk@v10.0.300...v10.0.301)

---
updated-dependencies:
- dependency-name: dotnet-sdk
  dependency-version: 10.0.301
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…pper

The Tiered OAuth challenge built the IdP /connect/authorize redirect without a
client_id because the registration-store lookup returned a phantom non-null
TieredClient on a no-match:

- UdapClientRegistrationStore.FindTieredClientById did entity.ToModel(), and
  TieredClientMapper.ToModel(null) returns a non-null empty object, so 'not found'
  read as 'found' with a null ClientId.
- The challenge also looked up by the wrong column (ClientId) while passing the IdP
  base URL.

The phantom object made idpClient != null, so the handler skipped copying the freshly
issued client_id (the 'if (idpClient == null)' guard), and the authorize URL went out
without client_id.

Fixes:
- FindTieredClientById maps only when found (entity?.ToModel()).
- Add FindTieredClientByIdPBaseUrl (matches the key UpsertTieredClient stores under)
  to the interface, EF store, and in-memory store.
- TieredOAuthAuthenticationHandler resolves the existing tiered client by IdP base URL.

Also adds a TODO noting the missing regression coverage (EF-store tests, a shared
InMemory/EF store-contract test, and a tiered re-login test) that let this ship.
Add markdown conversions of Exchange Purposes SOP v5.1, Treatment XP
Implementation SOP v2.0, and IAS XP Implementation SOP v3.0 final
(all published July 2026). Source PDFs are kept locally only (*.pdf
is gitignored repo-wide).

Findings in TEFCA-SOP-July-2026-Impact.md:
- XP code set is stale: v5.1 adds T-HCO-QAI/POP/PTSAFETY/PERF and
  T-GOVDTRM-SSD/ACP, removes T-HCO-QM (SDK implements v4.0's 12 codes)
- Conformance bug: SDK uses extension key "tefca-ias" but Facilitated
  FHIR SOP v2.0 Table 4 defines "tefca_ias" (underscore)
- Treatment XP SOP v2.0 6.2 adds hl7-b2b content rules (NPI/TIN in
  organization_name, RCE Directory ResourceID as organization_id)

Implementation deferred until Duende upgrade lands. The udaped UI tool
(separate repo) also needs the extension key and XP code updates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… net10.0

Duende IdentityServer 8.x targets .NET 10 only, so Udap.Server,
Udap.Server.Storage, Udap.UI, Udap.Ssraa.Server, and Udap.Tefca.Server
drop net8.0/net9.0 (client-side libraries keep multi-targeting since
Duende.IdentityModel 8.1.0 still supports net8.0). Also removes the
now-dead net8/net9 conditional package pins and updates dotnet-ef to
10.0.9 for EF Core 10 migrations.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- All Duende store/service/validator interfaces gained required
  CancellationToken parameters; return types moved to
  IReadOnlyCollection<T> (UdapInMemoryResourceStore,
  UdapInMemoryIdentityProviderStore, UdapJwtSecretValidator,
  UdapJwtBearerClientAssertionSecretParser,
  UdapCustomTokenRequestValidator, UdapDiscoveryEndpoint).
- UdapTokenResponseGenerator: IClock -> TimeProvider in the base
  TokenResponseGenerator constructor; override signature takes ct.
- UdapAuthorizationResponseMiddleware now matches HTTP 303 (See Other)
  in addition to 302 - Duende 8 emits 303 unconditionally for
  authorization endpoint redirects (FAPI 2.0), which would otherwise
  bypass the UDAP error-transform on response start.
- Inline replacements for Duende extension helpers internalized in v8
  (IsNullOrEmpty, HasDuplicates).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mechanical updates across Udap.UI and both Udap.Identity.Provider
examples: pass HttpContext.RequestAborted to
IIdentityServerInteractionService / IEventService / IIdentityProviderStore /
IBackchannelAuthenticationInteractionService / ISessionManagementService /
IClientStore calls (GrantConsentAsync and DenyAuthorizationAsync take the
token before their trailing optional parameter), and rename
AuthorizationError -> InteractionError.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ConfigurationDb_v7Tov8 adds the 8 SAML configuration tables and
PersistedGrantDb_v7Tov8 adds the 3 SAML operational tables introduced
by Duende IdentityServer 8, for both UdapDb.SqlServer and
UdapDb.Postgres (snake_cased via the Npgsql contexts). The migration
hosts register TimeProvider.System, required by v8''s
TokenCleanupService at design time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Test doubles updated: StubClock extends TimeProvider (IClock removed),
  TestReplayCache/TestEventService take CancellationToken, ClientStore
  no longer takes ICancellationTokenProvider.
- Vendored pipeline helpers pass ct to interaction service calls.
- Redirect assertions reclassified: responses from Duende''s authorize
  endpoint (including redirect-to-login and /connect/authorize/callback)
  now expect 303 SeeOther; redirects issued by
  UdapAuthorizationResponseMiddleware, ASP.NET Challenge, login pages,
  and the federation signin handler remain 302.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Firely.Fhir.Packages 4.9.1 crashes with a duplicate-key error when two
manifests declare the same missing package at different versions, which
happens when ~/.fhir/packages contains us.core but not
hl7.terminology.r4 / hl7.fhir.uv.extensions.r4. Records the local fix
and why the upstream fix (5.0.2) is blocked on the deferred Hl7.Fhir
6.x migration.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Duende IdentityServer 7.4.7 -> 8.0.2 upgrade: net10.0-only server
libraries, v8 API migration, SAML table EF migrations, and test
updates for the new 303 authorization redirects.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…otnet-sdk-10.0.301

Bump dotnet-sdk from 10.0.300 to 10.0.301
…nd Treatment checks

Conformance fix (breaking): the TEFCA IAS authorization extension key is
"tefca_ias" per Facilitated FHIR SOP v2.0 Table 4; the SDK used "tefca-ias".
Renamed TefcaConstants.UdapAuthorizationExtensions.TEFCAIAS and all docs,
config, and test references. No legacy-key tolerance.

Exchange Purposes SOP v5.1 (breaking): add T-HCO-QAI, T-HCO-POP,
T-HCO-PTSAFETY, T-HCO-PERF, T-GOVDTRM-SSD, T-GOVDTRM-ACP; remove retired
T-HCO-QM. New TefcaConstants.ExchangePurposeCodes.All is the single
authoritative list; TefcaTokenValidator and TefcaRegistrationValidator now
derive from it instead of keeping hand-maintained copies.

New validations in TefcaTokenValidator:
- tefca_ias extension must carry a non-empty id_token (SOP v2.0 Table 4)
- Opt-in Treatment XP SOP v2.0 Section 6.2 checks via
  TefcaValidationOptions.EnforceTreatmentOrganizationIdentifiers:
  NPI/TIN appended to organization_name and organization_id present
  for T-TREAT/T-TRTMNT token requests

Also: PKI generator TEFCA client cert SANs updated to the v5.1 code set;
Udap.Tefca.Server docs README XP code list corrected (previously listed
draft-era names).

Tests: UdapServer.Tests 295 passed, Udap.Common.Tests 416 passed (both TFMs),
UdapMetadata.Tests 55 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.301 to 10.0.302.
- [Release notes](https://github.com/dotnet/sdk/releases)
- [Commits](dotnet/sdk@v10.0.301...v10.0.302)

---
updated-dependencies:
- dependency-name: dotnet-sdk
  dependency-version: 10.0.302
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…otnet-sdk-10.0.302

Bump dotnet-sdk from 10.0.301 to 10.0.302
TrustChainValidationResult.MatchedAnchor tells you the specific anchor the metadata chained to — the root the chain actually terminated at — plus its CommunityId/CommunityName.
@JoeShook
JoeShook merged commit ce7e6f5 into udap-tools:main Jul 20, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants