Skip to main content

Product Roadmap

This page tracks what is planned but not yet shipped. Standards and capabilities already implemented live in Implemented Standards and the release notes: items are removed from this page as they ship.

FAPI 2.0 Security Profile​

  • Goal: Give financial-grade and other high-assurance deployments a certified, standards-compliant security profile out of the box.
  • Action: Assemble the already-shipped building blocks (Pushed Authorization Requests, JWT-Secured Authorization Requests and Response Mode, DPoP, mutual-TLS client authentication with certificate-bound tokens, and Rich Authorization Requests) into a conformant FAPI 2.0 Security Profile configuration, and pursue OpenID Foundation certification.
  • Benefits: A verifiable trust signal for banking, open finance, healthcare, and government adopters; a direct on-ramp to Open Banking and EU Digital Identity (eIDAS 2.0) scenarios; assurance that the profile is correct by certification, not by self-assertion.
  • When: Q3 2026.

Automatic Signing Key Management​

  • Goal: Remove the operational burden of provisioning, rotating, and retiring signing and encryption keys by hand.
  • Action: Extend the current key configuration with a managed key lifecycle (automatic generation, scheduled rotation with an overlap window, publication of retiring keys in the JWKS until the tokens that depend on them expire, and final retirement) backed by a pluggable persistent key store with encryption at rest, so keys survive restarts and stay consistent across every instance behind a load balancer.
  • Benefits: Production-ready key hygiene out of the box; no broken signatures or lost sessions when an instance restarts or the cluster scales; smaller blast radius from a compromised key; parity with the on-by-default key management operators expect from a mature identity server.
  • When: Q4 2026.

Entity Framework Core and ASP.NET Identity Stores​

  • Goal: Eliminate the need for custom persistence code when integrating with existing .NET data stacks.
  • Action: Provide ready-made store implementations for Entity Framework Core and ASP.NET Identity, covering client registrations, authorization codes, refresh tokens, and user consent, with standard migration support and NuGet packages that plug directly into the existing DI setup.
  • Benefits: Cuts time-to-running-server for teams already using EF Core or ASP.NET Identity; removes a key adoption barrier for developers evaluating Abblix as a Duende IdentityServer alternative; brings parity with the ready-made setup experience of competing libraries.
  • When: Q4 2026.

End-to-End Observability: Structured Logging, Tracing, and Audit​

  • Goal: Provide production-ready observability across every OIDC operation without cluttering business logic.
  • Action: Build on the existing source-generated structured logging with cross-cutting, aspect-oriented capture of authentication flows, token operations, and security events at configurable verbosity; add OpenTelemetry distributed tracing across the endpoints; and expose a structured audit-and-events subsystem for compliance-grade records.
  • Benefits: Faster troubleshooting of production issues, end-to-end request tracing across services, compliance audit trails, and security monitoring without hand-written logging code.
  • When: Q1 2027.

Server-Side Sessions and Reference Tokens​

  • Goal: Give operators real-time control to enumerate and revoke active sessions and access tokens.
  • Action: Add server-side session storage that can be listed and remotely terminated, together with opaque reference access tokens validated by introspection against the server store rather than by self-contained signature, so a token or session can be killed the instant it is revoked.
  • Benefits: Immediate revocation for incident response and offboarding, a full inventory of who is signed in, smaller tokens on the wire, and tighter control for regulated environments.
  • When: Q2 2027.

OpenID Federation 1.0​

  • Goal: Enable federated trust and identity provider chaining across organizational boundaries.
  • Action: Implement the OpenID Federation 1.0 specification: trust relationships with other identity providers without manual configuration, automatic metadata discovery, and trust chain validation.
  • Benefits: Simplified integration with multiple upstream identity providers, dynamic trust establishment without pre-configuration, support for multi-organization scenarios, and centralized authentication policy enforcement across federated environments.
  • When: Q2 2027.
  • Reference: OpenID Federation 1.0
INFO

We welcome your suggestions on our Abblix GitHub page. Looking forward to your proposals!