ProAuth 3.2.3

ProAuth 3.2.3 improves OpenID Connect provider compatibility, resource management, and reliability for existing v1 integrations and database migrations. This release also incorporates upstream security fixes while maintaining compatibility with existing v1 integrations.

ACTION REQUIRED

Review the following items where they apply to your installation:

• Generic OpenID Connect providers: AdditionalScopes now preserves case. Check that configured scope names match your provider's requirements. (#2954)
• ProAuth 2.x SQL Server migrations: Install the updated CLI before running proauthcli migrate v2tov3 to migrate an existing ProAuth 2.x SQL Server installation to ProAuth 3.x. (#2953)

Maintenance Release

Internal NuGet and npm packages, the .NET SDK, and runtime and base images have been updated to current patch and minor versions to address security advisories. This dependency refresh introduces no major version upgrades or functional changes, and no customer action is required for these security updates. (#2955)

Core

Core

More flexible OpenID Connect provider compatibility

Administrators can now configure additional compatibility settings for each generic OpenID Connect identity provider, including PKCE, nonce requirements, UserInfo retrieval, pushed authorization requests, discovery URLs, scopes, and provider-specific authorization parameters. Existing configurations retain their previous defaults. (#2954)

Explicit overrides support providers with compatibility limitations, including LinkedIn in the tested configuration. Disabling PKCE or nonce reduces authorization-code binding protections and should be limited to providers that require these exceptions. (#2954)

Option changes and resets now propagate across replicas. Logout also completes locally when an upstream provider does not offer an end-session endpoint; the upstream provider's session remains active. (#2954)

More efficient tenant authentication and UserStore resource management

Improved resource management reduces overhead in tenant authentication and UserStore operations, including when authentication configurations are changed or removed. Tenant and user-store isolation is preserved. (#2957)

Security

Security

Security maintenance baseline refresh

Updated NuGet and npm packages, the .NET SDK, and runtime and base images incorporate upstream fixes to reduce exposure to security advisories. This routine patch and minor version maintenance keeps the platform current and stable without major dependency upgrades or functional changes. (#2955)

Platform Stability

Reliable metadata updates for existing v1 integrations

Metadata operations in existing v1 integrations now work reliably, including adding client application metadata through batch requests. Updates preserve creation audit information and existing metadata entries. The v1 client fix prevents an unexpected-status error after a successful batch PATCH update. (#2958)

The v1 API remains backward compatible: existing routes, payload formats, and previously supported response codes remain supported. Existing integrations do not require a client update for compatibility; integrations experiencing the batch PATCH client error can update their client package or regenerate it from the corrected API specification to receive the fix. (#2958)

Reliable CLI startup for v2-to-v3 SQL Server migrations

The CLI package now includes the SQL Server driver runtime files required by proauthcli migrate v2tov3. This resolves a startup failure that could prevent migration from an existing ProAuth 2.x SQL Server installation to ProAuth 3.x. (#2953)