You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
IdentityModel Extensions for .NET provide assemblies that are interesting for web developers that wish to use federated identity providers for establishing the caller's identity.
5
+
The **IdentityModel Extensions for .NET** library provides robust tools to enhance authentication and authorization workflows in your .NET applications. Backed by the Entra team, this library simplifies working with OpenID Connect (OIDC), OAuth2.0, and JSON Web Tokens (JWT) in .NET.
6
+
7
+
Whether you're building secure APIs, implementing token validation, or managing claims, this library is designed to handle the heavy lifting for you.
8
+
9
+
> **Why IdentityModel?**
10
+
> -**Widely Adopted:** Trusted by thousands of developers to integrate OIDC and OAuth2.0 standards.
11
+
> -**Secure by Design:** Built with security as a priority to reduce common vulnerabilities.
12
+
> -**Extensible:** Easily extend or customize for advanced use cases.
13
+
> -**Battle hardened:** Validates 5+ trillion requests daily, and growing.
6
14
7
15
## Versions
8
16
9
17
You can find the release notes for each version [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases). Older versions can be found [here](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/Release-Notes).
10
18
11
-
## IdentityModel 7x
19
+
## Version Lifecycle and Support Matrix
20
+
21
+
See [Long Term Support policy](./supportPolicy.md) for details.
22
+
23
+
| Major Version | Last Release | Status |
24
+
| --------------|--------------|--------|
25
+
| 8.x | 8.9.0 | Active (Current) |
26
+
| 7.x | 7.7.1 | Supported (LTS) through .NET 8 LTS lifetime Nov 10, 2026|
27
+
| 6.x | 6.36.0 | Not supported since May 2024|
28
+
| 5.x | 5.7.0 | Supported (LTS), tied to the Microsoft.Owin.Security.JWT 4.2.2 lifetime |
29
+
30
+
## IdentityModel 8.x?
31
+
32
+
Version `8.x` introduces significant updates and improvements:
33
+
-**Enhanced Performance:** Optimized token validation to handle high-throughput scenarios.
34
+
-**.NET Compatibility:** Fully compatible with .NET 9.
35
+
36
+
>🧭LTS: Supported through .NET 9 LTS lifetime: May 12, 2026 + .NET 10 LTS (~3 years).
37
+
38
+
## IdentityModel 7.x
39
+
40
+
[IdentityModel 7x](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/IdentityModel-7x) introduced several improvements related to serialization and consistency in the API, which provide a better user experience for developers, as well as full AOT compatibility on .NET, and considerable performance improvements compared to IdentityModel 6x.
12
41
13
-
We are excited to announce the release of [IdentityModel 7x](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/IdentityModel-7x), a major update to our popular .NET auth validation library. This new version introduces several improvements related to serialization and consistency in the API, which will provide a better user experience for developers, as well as full AOT compatibility on .NET, and huge perf improvements compared to 6x.
42
+
>🧭LTS: Supported through .NET 8 LTS lifetime: Nov 10, 2026.
43
+
>
44
+
>⚡Recommendation: Move to 8.x.
14
45
15
-
## Note about 6.x
46
+
## IdentityModel 6.x
16
47
17
-
We bumped the release from 6.x to 7.x.
18
-
We are maintaining two releases from two different branches.
19
-
dev - 7.x
20
-
dev6x - 6.x
48
+
>🧭Deprecated: Support ended with .NET 7 LTS lifetime: May 2024.
49
+
>
50
+
>⚡Action: Move to 8.x.
21
51
22
-
dev6x will be maintained until March 2024, at which point, you will need to move to 7x to continue to get the latest and greatest improvements and security updates.
52
+
## IdentityModel 5.x
53
+
54
+
__Not a recommended version__
55
+
56
+
>🧭LTS: Supported for Microsoft.Owin.Security.JWT
57
+
>
58
+
>⚡Action: Move to 8.x.
23
59
24
60
## Samples and Documentation
25
61
@@ -33,20 +69,18 @@ The scenarios supported by IdentityModel extensions for .NET are described in [S
33
69
34
70
## Community Help and Support
35
71
72
+
Report a bug or request a feature directly in the [GitHub repo](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/new/choose).
73
+
74
+
Have a design proposal? Please submit [a design proposal](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/new?assignees=&labels=design-proposal&projects=&template=design_proposal.md) before starting work on a PR to ensure it means the goals/objectives of this library and it's priorities.
75
+
36
76
We leverage [Stack Overflow](http://stackoverflow.com/) to work with the community on supporting Microsoft Entra and its SDKs, including this one! We highly recommend you ask your questions on Stack Overflow (we're all on there!) Also browse existing issues to see if someone has had your question before.
37
77
38
78
We recommend you use the "identityModel" tag so we can see it! Here is the latest Q&A on Stack Overflow for IdentityModel: [https://stackoverflow.com/questions/tagged/identityModel](https://stackoverflow.com/questions/tagged/identityModel)
39
79
40
-
Have a design proposal? Please submit [a design proposal](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/new?assignees=&labels=design-proposal&projects=&template=design_proposal.md) before starting work on a PR to ensure it means the goals/objectives of this library and it's priorities.
41
-
42
80
## Security Reporting
43
81
44
82
See [SECURITY.md](./SECURITY.md)
45
83
46
-
## Security Vulnerability in Microsoft.IdentityModel.Tokens 5.1.0
47
-
48
-
IdentityModel Extensions library Microsoft.IdentityModel.Tokens has a known security vulnerability affecting version 5.1.0. Please update to >= 5.1.1 immediately. An updated package is available on NuGet. For more details, see the [security notice](./SECURITY_NOTICE.md).
49
-
50
84
## Contributing
51
85
52
86
All code is licensed under the MIT license and we triage actively on GitHub. We enthusiastically welcome contributions and feedback. See [Contributing.md](./Contributing.md) for guidelines, branch information, build instructions, and legalese.
Every Microsoft product has a lifecycle. The lifecycle begins when a product is released and ends when it's no longer supported. Knowing key dates in this lifecycle helps you make informed decisions about when to upgrade or make other changes to your software. This product is governed by [Microsoft's Modern Lifecycle Policy](https://learn.microsoft.com/en-us/lifecycle/policies/modern).
6
+
7
+
## Overview
8
+
9
+
The Microsoft suite of auth libraries provides comprehensive tools for identity and security token processing in .NET, and non-.NET, applications, including authentication, authorization, token validation, and integration with Entra ID and other IdPs. To provide clarity and predictability for developers, these libraries follow a Long-Term Support (LTS) policy similar in style to the .NET Core/.NET platform LTS story. This policy defines how long each major version of each library is supported, which versions receive updates (especially security fixes), and when older versions are deprecated. The goal is to ensure developers know which version is safe to use and when to upgrade, in alignment with .NET’s own support cadence.
10
+
11
+
## Support Policy Guiding Principles
12
+
The support policy can be summarized by three key rules:
13
+
1.**“Last Major Release” Support Window:** For each major version of the library (v5, v6, v7, v8, etc.), only the latest patch release of that major version is officially supported once a new major version is released. This last release of a major version (for example, 7.7.1 for the 7.x branch) will continue to be supported for a grace period of 180 days after the next major (v8.0) comes out or for the entire lifespan of the .NET LTS release that the library is associated with – whichever is longer. In other words, if a given major version of IdentityModel ships as part of a .NET LTS wave, it inherits that longer support timeline. For example, IdentityModel 7.x is shipped as part of ASP.NET Core in .NET 8 (an LTS release), then IdentityModel 7.x will be supported throughout the supported lifetime of .NET 8. If a major is not tied to an LTS .NET, the default support overlap is 180 days.
14
+
2.**Deprecation of Older Versions on New Major Release:** When a new major version of the library is released (e.g., 8.0.0), all previous minor/patch versions of the previous major (e.g., 7.0.0 up to 7.7.0) are immediately considered deprecated, only the last patch release of the previous major (e.g., 7.7.1) remains supported during the 180-day overlap or LTS period as described above. Earlier patches in that branch will no longer receive updates. For example, once 8.0.0 is released, the entire 7.x series before 7.7.1 is deprecated. Developers should move to 7.7.1 (the final 7.x release) or upgrade to 8.x for continued support.
15
+
3.**Security Fixes Only in Supported Versions:** Security fixes and critical bug fixes will be provided only for the supported versions – namely, the latest patch of the latest major, and in some cases the latest patch of the previous major during the overlap window. Older majors (and any old patch versions) will not receive security updates once they are out of support. This means if a vulnerability is discovered, the team will issue a fix in the current supported release (and possibly the last release of the previous major if still within 180-day/LTS overlap), but will not back-port fixes to earlier, deprecated patch versions. In practice, organizations must upgrade to the supported version to get the fix. (For example, a security advisory might instruct users to update to 7.7.1 or 8.x to resolve an issue, as older 7.x builds would not be patched.)
16
+
17
+
## Supported versions
18
+
The following table lists IdentityModel versions currently supported and receiving security fixes.
19
+
20
+
| Major Version | Last Release | Patch release date| Support phase|End of support |
0 commit comments