Product Roadmap

This page tracks what is planned but not yet shipped. Standards and capabilities already implemented live in Implemented Standards and the release notes: items are removed from this page as they ship.

FAPI 2.0 Security Profile

• Goal: Give financial-grade and other high-assurance deployments a profile the OpenID Foundation has tested, so its correctness rests on somebody else.
• Action: The profile itself ships: a client opts into FAPI 2.0 and the server then holds it to Pushed Authorization Requests, DPoP, PKCE with S256 only and the authorization code alone. What remains is running the OpenID Foundation conformance suite against that configuration and carrying it through certification.
• Benefits: A verifiable trust signal for banking, open finance, healthcare, and government adopters; a direct on-ramp to Open Banking and EU Digital Identity (eIDAS 2.0) scenarios; assurance that the profile is correct by certification, not by self-assertion.
• When: Q3 2026.

Automatic Signing Key Management

• Goal: Remove the operational burden of provisioning, rotating, and retiring signing and encryption keys by hand.
• Action: A deployment backed by HashiCorp Vault, OpenBao or Azure Key Vault already has this: keys are generated, rotated on a schedule with a propagation window, kept in the JWKS while the tokens they signed are alive, then dropped, and the ring is persisted sealed so every instance sees the same keys after a restart. What remains is the same lifecycle for a deployment that has no vault to lean on, which today hand-manages its keys.
• Benefits: Production-ready key hygiene out of the box; no broken signatures or lost sessions when an instance restarts or the cluster scales; smaller blast radius from a compromised key; parity with the on-by-default key management operators expect from a mature identity server.
• When: Q4 2026.

Entity Framework Core and ASP.NET Identity Stores

• Goal: Eliminate the need for custom persistence code when integrating with existing .NET data stacks.
• Action: Provide ready-made store implementations for Entity Framework Core and ASP.NET Identity, covering client registrations, authorization codes, refresh tokens, and user consent, with standard migration support and NuGet packages that plug directly into the existing DI setup.
• Benefits: Cuts time-to-running-server for teams already using EF Core or ASP.NET Identity; removes a key adoption barrier for developers evaluating Abblix as a Duende IdentityServer alternative; brings parity with the ready-made setup experience of competing libraries.
• When: Q4 2026.

End-to-End Observability: Structured Logging, Tracing, and Audit

• Goal: Provide production-ready observability across every OIDC operation without cluttering business logic.
• Action: Build on the existing source-generated structured logging with cross-cutting, aspect-oriented capture of authentication flows, token operations, and security events at configurable verbosity; add OpenTelemetry distributed tracing across the endpoints; and expose a structured audit-and-events subsystem for compliance-grade records.
• Benefits: Faster troubleshooting of production issues, end-to-end request tracing across services, compliance audit trails, and security monitoring without hand-written logging code.
• When: Q1 2027.

Server-Side Sessions and Reference Tokens

• Goal: Give operators real-time control to enumerate and revoke active sessions and access tokens.
• Action: Add server-side session storage that can be listed and remotely terminated, together with opaque reference access tokens validated by introspection against the server store rather than by self-contained signature, so a token or session can be killed the instant it is revoked.
• Benefits: Immediate revocation for incident response and offboarding, a full inventory of who is signed in, smaller tokens on the wire, and tighter control for regulated environments.
• When: Q2 2027.

OpenID Federation 1.0

• Goal: Enable federated trust and identity provider chaining across organizational boundaries.
• Action: Implement the OpenID Federation 1.0 specification: trust relationships with other identity providers without manual configuration, automatic metadata discovery, and trust chain validation.
• Benefits: Simplified integration with multiple upstream identity providers, dynamic trust establishment without pre-configuration, support for multi-organization scenarios, and centralized authentication policy enforcement across federated environments.
• When: Q2 2027.
• Reference: OpenID Federation 1.0