Appearance
ProAuth 3.0.0
This major release delivers the ProAuth 3 platform with a large security expansion, new v2 Management and User Store APIs, and a modernized database and deployment model. It also ships the current AdminApp aligned with the new APIs and refreshed runtime and dependency baselines, while the redesigned Admin UI is scheduled for a follow-up release. Because ProAuth 3.0.0 introduces several breaking changes, review the migration documentation carefully before planning the upgrade.
BREAKING CHANGE
Upgrading from ProAuth 2.x to 3.x requires a planned maintenance window. The database schemas move to the new ProAuth 3 layout and must be migrated before the application upgrade is completed, so a short downtime is required for the transition. Take database backups before starting and follow the documented migration sequence, including the CLI-assisted migration commands, in the Migration Guide. (#2919)
ACTION REQUIRED
ProAuth 3 includes additional migration work beyond the database change. Custom authentication views must be rewritten from Razor to Fluid templates, Helm chart secret and resource naming conventions have changed, legacy TwoFactor or SecondFactor naming must be updated to MFA terminology in v3-facing assets, and existing CLI YAML files must be migrated to the new API-versioned format before reuse. Review the full mapping tables and migration steps in the Migration Guide. (#2881) (#2917) (#2922) (#2923)
Core
CoreNew V2 Management API and User Store API
ProAuth 3 introduces v2 Management and User Store APIs under /api/management/v2/ and /api/userstore/v2/, with CQRS-lite command-based write operations, type-safe PATCH endpoints, dedicated relationship endpoints, and a new hierarchical RBAC permission model for fine-grained administration. The release adds new .NET client libraries for v2 integrations, while keeping the v1 API functional but deprecated for a future major removal. (#2878)
Redesigned Authentication Views and Safer Customization Model
Authentication views have been rebuilt around Fluid templates and Tailwind CSS, giving tenants a modern responsive default experience and a safer customization model that avoids server-side code execution in custom templates. Branding changes can now be applied more cleanly through shared head template overrides and CSS variables, and authentication flow state is handled server-side rather than through legacy hidden field patterns. This change is a major migration point for installations with custom views. (#2881)
Expanded Standards Coverage for Modern OIDC and OAuth Flows
ProAuth now supports the Device Authorization Grant for input-constrained devices, reference tokens as an alternative to JWT access tokens, pairwise subject identifiers for stronger privacy, the OIDC claims request parameter for fine-grained claim selection, and full address and phone scope support across discovery, consent, ID tokens, and UserInfo responses. Together these additions expand standards coverage for device, privacy, and claims-centric integration scenarios. (#2886) (#2891) (#2897) (#2898) (#2905)
Improved Login Flow Extensibility and Data Validation
User questionnaire processing now validates submitted fields more strictly, supports configurable required fields and simple input rules, and avoids unnecessary questionnaire routing when no active questionnaire is configured. This helps reduce inconsistent authentication experiences and prevents incomplete custom form submissions from being accepted. (#2907)
PostgreSQL Support and New Database Migration Flow
ProAuth 3 adds PostgreSQL as a supported database platform alongside SQL Server and replaces the previous SSDT or DACPAC deployment model with EF Core migrations. Database objects are now deployed into dedicated proauth and userstore schemas, and ProAuth CLI migration tooling is available to help existing 2.x SQL Server installations move to the new v3 schema layout in a controlled way. (#2919)
Updated MFA Naming and Modernized CLI YAML Format
Multi-factor authentication terminology has been standardized across the product, replacing legacy TwoFactor and SecondFactor naming with MFA and MfaFactor throughout v2 APIs, configuration resources, import/export formats, and documentation. In parallel, ProAuth CLI configuration moves to an API-versioned YAML format based on explicit apiVersion and kind fields with clearer relationship handling, and the CLI includes migration commands for existing data, label, and view definition files. (#2922) (#2923)
Security
SecurityAdvanced Client Security and FAPI 2.0 Building Blocks
ProAuth 3 delivers a substantial upgrade in advanced protocol security, including Pushed Authorization Requests, JWT-based client authentication with private_key_jwt and client_secret_jwt, mutual TLS client authentication with certificate-bound tokens, Demonstration of Proof-of-Possession tokens, JWT-secured authorization requests, and full FAPI 2.0 Security Profile enforcement. Authorization responses now also carry the iss parameter for mix-up attack protection. These capabilities enable higher-assurance deployments in regulated environments and provide the building blocks required for stronger sender-constrained and tamper-resistant authorization flows. (#2888) (#2889) (#2890) (#2892) (#2894) (#2899) (#2900)
Token Protection, Privacy, and Integrity Enhancements
Token handling has been strengthened with support for JSON Web Encryption for ID tokens and access tokens, JWT-wrapped token introspection responses for integrity-protected introspection, and privacy-oriented subject handling through pairwise identifiers. ProAuth 3 also supports opaque reference tokens for scenarios where token contents should remain server-side and hidden from intermediaries. (#2891) (#2893) (#2897) (#2901)
Expanded Logout Interoperability
OpenID Connect logout interoperability has been extended with both back-channel logout and front-channel logout support. ProAuth can now send signed logout notifications to registered client applications server-to-server and can also trigger browser-based logout notifications through hidden iframes, allowing broader coordination of session termination across participating clients. (#2883) (#2884)
Passkeys and Hardened User Store Authentication
ProAuth now supports passkeys for user store sign-in and MFA scenarios, enabling stronger and more user-friendly WebAuthn-based authentication. The release also hardens passkey and account-management behavior with stricter tenant and identity-provider validation, CSRF protection for account APIs, HTTPS-only cookie handling, configurable relying party metadata and allowed origins, and more carefully sanitized error responses. (#2908)
Infrastructure
InfrastructurePlatform and Runtime Modernization
The ProAuth platform has been upgraded from .NET 9 to .NET 10 across the ASP.NET Core-based solution to stay aligned with the latest Microsoft runtime for maintainability, compatibility, performance, and security. This release also refreshes internal runtime and dependency baselines so the platform remains current without intended functional regressions for customers. (#2874) (#2910)
Breaking Helm Chart and Kubernetes Resource Model Update
ProAuth 3 standardizes Helm chart secrets, Kubernetes resource names, template naming, and labels, including clearer app.kubernetes.io/* labeling and direct .NET configuration environment variable keys for grouped secrets. This is a breaking infrastructure change for deployments that rely on pre-created secrets, custom automation, selectors, dashboards, monitoring integrations, or scripts that reference legacy names and labels. As part of the Kubernetes packaging refresh, the wait-for image dependency now uses ghcr.io/4tecture/k8s-init-wait-for. (#2917)
AdminApp
AdminAppExisting AdminApp Continues on the New Platform Baseline
ProAuth 3.0.0 continues to ship the existing AdminApp for this release cycle, updated to operate against the new API landscape and current runtime and dependency baselines. The redesigned Admin UI is not part of 3.0.0 and is planned for a subsequent release.
Platform Stability
Security Maintenance Baseline Refresh
Internal components, NuGet packages, SDK layers, and runtime or base images have been updated to current patch and minor versions to absorb upstream security advisories and keep the release baseline stable. No customer action is required for this maintenance refresh. (#2910)