Bump Microsoft.Identity.Web and Microsoft.IdentityModel.Protocols.OpenIdConnect

[dependabot]

Updated Microsoft.Identity.Web from 4.14.2 to 4.16.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.16.0

What's Changed

• Add 4.15.0 release notes by @​iarekk in Add 4.15.0 release notes AzureAD/microsoft-identity-web#4050
• Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in Post-release 4.15.0: mark APIs shipped and bump version AzureAD/microsoft-identity-web#4060
• Add Sidecar 1.1.2 changelog by @​soodt in Add Sidecar 1.1.2 changelog AzureAD/microsoft-identity-web#4070
• Fix FIC telemetry enrichment during credential warm-up and assertion cache hits by @​neha-bhargava in Fix FIC telemetry enrichment during credential warm-up and assertion cache hits AzureAD/microsoft-identity-web#4072
• Update agentic docs to cover current behavior by @​Avery-Dunn in Update agentic docs to cover current behavior AzureAD/microsoft-identity-web#4077
• Bump the notsecurity group with 4 updates by @​dependabot[bot] in Bump the notsecurity group with 4 updates AzureAD/microsoft-identity-web#4074

Full Changelog: AzureAD/microsoft-identity-web@4.15.0...4.16.0

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.22.0 to 8.23.0.

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.23.0

What's Changed

• Backport configurable SHR p claim path comparison to 8.x by @​debchoudhury-id4s in Backport configurable SHR p claim path comparison to 8.x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3577
• Backport SHR p-claim percent-encoding hex case handling to dev8x by @​debchoudhury-id4s in Backport SHR p-claim percent-encoding hex case handling to dev8x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3579
• Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package by @​iNinja in Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3547
• Include WS-Trust in build pipelines by @​iNinja in Include WS-Trust in build pipelines AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3604
• Log IDX10650 decryption-tag failures below Error during multi-key decryption by @​RojaEnnam in Log IDX10650 decryption-tag failures below Error during multi-key decryption AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3582
• Support ML-DSA AKP keys in JsonWebKeySet by @​iNinja in Support ML-DSA AKP keys in JsonWebKeySet AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3597
• Add Composite ML-DSA support (internal, gated) by @​iNinja in Add Composite ML-DSA support (internal, gated) AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3596

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)