IdentityModel.AspNetCore.OAuth2Introspection => Duende.AspNetCore.Authentication.OAuth2Introspection

[dennisoehme]

This MR migrates OAuth2 token introspection from the deprecated IdentityModel package to the maintained Duende package and tightens runtime safety for JWT-profile signing.

Why this change

• IdentityModel.AspNetCore.OAuth2Introspection is deprecated / legacy and no longer maintained on NuGet.
• The maintainers officially rebranded it to Duende.AspNetCore.Authentication.OAuth2Introspection and recommend updating references.
• Duende is the actively maintained line with current docs/releases and net10.0 support, which matches this repository’s target.

What changed

• Package migration

  • Directory.Packages.props
    • IdentityModel.AspNetCore.OAuth2Introspection 6.2.0 -> Duende.AspNetCore.Authentication.OAuth2Introspection 7.0.1
  • src/Zitadel/Zitadel.csproj
    • package reference switched to Duende

• Namespace updates

  • src/Zitadel/Authentication/Options/ZitadelIntrospectionOptions.cs
    • using IdentityModel.AspNetCore.OAuth2Introspection -> using Duende.AspNetCore.Authentication.OAuth2Introspection
  • src/Zitadel/Extensions/ApplicationBuilderExtensions.cs
    • using IdentityModel.Client -> using Duende.IdentityModel.Client
    • added using Duende.AspNetCore.Authentication.OAuth2Introspection

• Duende API alignment + safety fix

  • Removed options.EnableCaching = ... assignment (property not available in Duende 7 options).
  • Replaced unsafe authority usage in JWT profile flow:
    • before: GetSignedJwtAsync(options.Authority!)
    • now: fail-fast validate Authority, capture validated local authority, then call GetSignedJwtAsync(authority).
  • Added explicit configuration-time exception when JwtProfile is set but Authority is missing/blank.

Behavior impact

• Functional behavior is unchanged for valid configurations.
• Misconfigured JwtProfile flows now fail early with a clear error instead of relying on null-forgiving behavior.
• This migration tracks the official maintained package line.

Official references

• Deprecated old package: IdentityModel.AspNetCore.OAuth2Introspection on NuGet
• Maintainer rebrand notice: README (raw) in DuendeArchive
• New package: Duende.AspNetCore.Authentication.OAuth2Introspection on NuGet
• Official docs: Duende Introspection overview
• Options/API docs: Duende Introspection options