1.0.0-rc2

Features

• How can you inject a service into an implementation of IClaimsTransformer? (#718)
• Authorization infrastructure does not handle "per action permissions" use case well (#670)
• Consider adding Async version for AddAssertion sugar (#657)
• SaveTokenAsClaim for JwtBearer (#639)
• [Authorization] Consider base class to make building custom policies/requirements easier (#575)
• Implement the hybrid flow, unify code and authorization flows (#456)
• Populate returnURL on Forbidden mapping for cookie auth (#335)
• [AuthZ] Investigate if we can turn policyName overloads into extension methods (#266)

Bugs Fixed

• Update OIDC package version to be 1.0.0-rc2 (#808)
• Exception thrown when 'Microsoft.AspNetCore.Authentication.JwtBearer' tries to log a message (#794)
• AuthenticationHandler.InitializeAsync chokes when HandleAuthenticateAsync returns null (#760)
• DefaultAuthorizationService call to _logger.UserAuthorizationSucceeded always has a null user (#755)
• What should be the defaults for ResponseType for OIDC (#744)
• Auth handlers should unregister themselves after Next (#704)
• Clean up OIDC events (#690)
• Return givename and surname claims from Facebook provider by default. (#688)
• Can't find working example of getting first_name claim using Facebook rc2 (#654)
• Consider moving GenerateCorrelationId and ValidateCorrelationId to RemoteAuthenticationHandler (#647)
• TwitterHandler doesnt save all tokens as claims when SaveTokensAsClaims is true (#632)
• AuthorizationHandler: where TResource : class requirement (#630)
• Authentication cookie is badly renewed when the security stamp has been validated (#628)
• The values of Roles property in AuthorizeAttribute aren't trimmed (#627)
• Discussion for Scope being a list and not a string? (#614)
• Split Microsoft.Owin.Security.Cookies.Interop into 2 packages (#611)
• Update Twitter AuthenticationEndpoint (#600)
• JwtBearer projects targets dnx451 and dnxcore50 (#590)
• The dependency Microsoft.AspNet.Authentication.OpenIdConnect 1.0.0-rc2-16009 does not support framework .NETPlatform,Version=v5.4 (#576)
• Consider making AutomaticAuthenticate true by default for Cookies (#569)
• Update Google API endpoints (#566)
• Update facebook provider to v2.5 APIs (#565)
• Stop using AuthenticateResult.Success(ticket: null) (#555)
• AuthenticationProperties is not available from OpenIdConnectAuthenticationNotifications.RedirectToIdentityProvider (#546)
• SaveTokensAsClaims defaults (#526)
• Update the OAuth2 handler to log error_description and error_uri when receiving an error (#512)
• Can't get email claim from Facebook (#435)
• Revisit the OIDC/OAuth2 bearer middleware to stop re-throwing exceptions for invalid tokens (#411)