<h1id="migrate-to-openiddict-rc3">Migrate to OpenIddict RC3</h1>
<h2id="whats-new-in-openiddict-rc3">What's new in OpenIddict RC3?</h2>
<p>The announcement listing the changes introduced in this milestone can be found <ahref="https://kevinchalet.com/2018/06/20/openiddict-rc3-is-out/">here</a>.</p>
<h2id="update-your-packages-references">Update your packages references</h2>
<p>For that, simply update your <code>.csproj</code> file to point to the newest OpenIddict packages:</p>
</code></pre><divclass="TIP"><h5>Tip</h5><p>Note: if you have an explicit reference to <code>AspNet.Security.OAuth.Validation</code> or <code>OpenIddict.Mvc</code>,
you can safely remove these dependencies: they are now transitively referenced by the <code>OpenIddict</code> metapackage.</p>
</div>
<divclass="IMPORTANT"><h5>Important</h5><p>Note: if your application references <code>OpenIddict.Models</code> or <code>OpenIddict.Stores</code>, you MUST remove them as these packages are no longer used in RC3.</p>
</div>
<h2id="use-the-new-openiddict-services-registration-apis">Use the new OpenIddict services registration APIs</h2>
<p>To offer a better user experience, the registrations APIs exposed by OpenIddict have been reworked. Updating your code should be quite straightforward:</p>
<pre><codeclass="lang-csharp">// In OpenIddict RC2, all the options used to be grouped.
// This API was removed as client identification is now
// required by default. You can remove or comment this line.
//
// options.RequireClientIdentification();
options.EnableRequestCaching();
// This API was removed as scope validation is now enforced
// by default. You can safely remove or comment this line.
//
// options.EnableScopeValidation();
options.DisableHttpsRequirement();
});
</code></pre><h2id="move-to-the-openiddict-validation-handler-optional">Move to the OpenIddict validation handler (optional)</h2>
<p>While not required, moving to the new validation handler is recommended:</p>
<pre><codeclass="lang-csharp">// Replace...
services.AddAuthentication()
.AddOAuthValidation();
// ... by:
services.AddOpenIddict()
.AddValidation();
</code></pre><divclass="TIP"><h5>Tip</h5><p>Note: the OpenIddict validation handler lives in the <code>OpenIddict.Validation</code> package, which is referenced by the <code>OpenIddict</code> metapackage.
You don't have to explicitly add a new <code>PackageReference</code> in your <code>.csproj</code> file to be able to use it.</p>
</div>
<h2id="if-necessary-create-new-application-entries">If necessary, create new application entries</h2>
<p>OpenIddict now rejects unauthenticated token/revocation requests by default.</p>
<p>If, after migrating to RC3, you see errors similar to this one:</p>
<blockquote><p><strong>invalid_request</strong> : The mandatory 'client_id' parameter is missing.</p>
</blockquote>
<p>Add an application entry for the client application and send the corresponding <code>client_id</code> as part of the token request:</p>
<pre><codeclass="lang-csharp">var descriptor = new OpenIddictApplicationDescriptor
<h1id="migrate-to-openiddict-rc2">Migrate to OpenIddict RC2</h1>
<h2id="whats-new-in-openiddict-rc2">What's new in OpenIddict RC2?</h2>
<p>The full list of changes can be found <ahref="https://github.com/openiddict/openiddict-core/milestone/8?closed=1">here</a>. It includes <strong>bug fixes</strong> (including a bug fix in the refresh token handling)
and new features like <strong>application permissions</strong>, that allow limiting the OpenID Connect features (endpoints and flows) an application is able to use.</p>
<p><strong>Migrating to OpenIddict RC2 (<code>1.0.0-rc2-final</code> and <code>2.0.0-rc2-final</code>) requires making changes in your database</strong>: existing properties have been reworked
(e.g <ahref="https://github.com/openiddict/openiddict-core/issues/497">to work around a MySQL limitation</a>) and new ones have been added to support the new features.
This procedure is quite easy and only requires a few minutes.</p>
<blockquote><p>Note: this guide assumes your application uses the OpenIddict Entity Framework Core 2.x stores. If you use a custom store, changes will have to be made manually.
A list of added/updated/renamed columns is available at the end of this guide.</p>
</blockquote>
<h2id="ensure-migrations-are-correctly-enabled-for-your-project">Ensure migrations are correctly enabled for your project</h2>
<p><strong>Before migrating to OpenIddict RC2, make sure migrations are already enabled for your application</strong>. If you have a <code>Migrations</code>
folder in your application root folder and an <code>__EFMigrationsHistory</code> table in your database, you're good to go.</p>
<p>If you don't have these Entity Framework Core artifacts, migrations are likely not enabled. To fix that, add the following entries in your <code>.csproj</code>:</p>
</code></pre><p>Then, open a new command line and add an initial migration using <code>dotnet ef migrations add InitialMigration</code> (<strong>but don't apply it!</strong>).</p>
<h2id="update-your-packages-references-1">Update your packages references</h2>
<p>For that, simply update your <code>.csproj</code> file to point to the newest OpenIddict packages:</p>
</code></pre><p>Run your application. Once it's correctly started, stop it and remove the migration script.</p>
<h2id="if-your-authorization-server-uses-introspection-make-sure-resources-are-set-in-the-authentication-ticket">If your authorization server uses introspection, make sure resources are set in the authentication ticket</h2>
<p><strong>Setting an explicit list of resources is now required to allow client applications to introspect a token.</strong>
For that, call <code>ticket.SetResources()</code> with the list of the client identifiers allowed to validate the token. E.g:</p>
<pre><codeclass="lang-csharp">var ticket = new AuthenticationTicket(
</code></pre><h2id="optionally-update-your-code-to-grant-applications-the-minimum-required-permissions">Optionally, update your code to grant applications the minimum required permissions</h2>
<p>Starting with RC2, OpenIddict includes an optional feature codenamed "app permissions" that allows
controlling and limiting the OAuth2/OpenID Connect features a client application is able to use.</p>
<p>To learn more about this feature, read the <ahref="../configuration/application-permissions.html">Application permissions documentation</a>.</p>
<h2id="list-of-changes-for-applications-using-custom-stores">List of changes (for applications using custom stores)</h2>
