# Product Roadmap

This page tracks what is planned but not yet shipped. Standards and capabilities already implemented live in [Implemented Standards](https://www.abblix.com/en/docs/implemented-standards) and the release notes: items are removed from this page as they ship.

## FAPI 2.0 Security Profile
- **Goal**: Give financial-grade and other high-assurance deployments a certified, standards-compliant security profile out of the box.
- **Action**: Assemble the already-shipped building blocks ([Pushed Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#par), JWT-Secured Authorization Requests and Response Mode, DPoP, [mutual-TLS client authentication](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) with certificate-bound tokens, and [Rich Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#rich-authorization-requests)) into a conformant [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) 2.0 Security Profile configuration, and pursue OpenID Foundation certification.
- **Benefits**: A verifiable trust signal for banking, open finance, healthcare, and government adopters; a direct on-ramp to Open Banking and EU Digital Identity (eIDAS 2.0) scenarios; assurance that the profile is correct by certification, not by self-assertion.
- **When**: Q3 2026.

## Automatic Signing Key Management
- **Goal**: Remove the operational burden of provisioning, rotating, and retiring signing and encryption keys by hand.
- **Action**: Extend the current key configuration with a managed key lifecycle (automatic generation, scheduled rotation with an overlap window, publication of retiring keys in the [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) until the tokens that depend on them expire, and final retirement) backed by a pluggable persistent key store with encryption at rest, so keys survive restarts and stay consistent across every instance behind a load balancer.
- **Benefits**: Production-ready key hygiene out of the box; no broken signatures or lost sessions when an instance restarts or the cluster scales; smaller blast radius from a compromised key; parity with the on-by-default key management operators expect from a mature identity server.
- **When**: Q4 2026.

## Entity Framework Core and ASP.NET Identity Stores
- **Goal**: Eliminate the need for custom persistence code when integrating with existing .NET data stacks.
- **Action**: Provide ready-made store implementations for Entity Framework Core and ASP.NET Identity, covering client registrations, [authorization codes](https://www.abblix.com/en/docs/glossary-overview#authorization-codes), refresh tokens, and user consent, with standard migration support and NuGet packages that plug directly into the existing [DI](https://www.abblix.com/en/docs/glossary-overview#di) setup.
- **Benefits**: Cuts time-to-running-server for teams already using EF Core or ASP.NET Identity; removes a key adoption barrier for developers evaluating Abblix as a Duende IdentityServer alternative; brings parity with the ready-made setup experience of competing libraries.
- **When**: Q4 2026.

## End-to-End Observability: Structured Logging, Tracing, and Audit
- **Goal**: Provide production-ready observability across every OIDC operation without cluttering business logic.
- **Action**: Build on the existing source-generated structured logging with cross-cutting, aspect-oriented capture of authentication flows, token operations, and security events at configurable verbosity; add OpenTelemetry distributed tracing across the endpoints; and expose a structured audit-and-events subsystem for compliance-grade records.
- **Benefits**: Faster troubleshooting of production issues, end-to-end request tracing across services, compliance audit trails, and security monitoring without hand-written logging code.
- **When**: Q1 2027.

## Server-Side Sessions and Reference Tokens
- **Goal**: Give operators real-time control to enumerate and revoke active sessions and access tokens.
- **Action**: Add server-side session storage that can be listed and remotely terminated, together with opaque reference access tokens validated by introspection against the server store rather than by self-contained signature, so a token or session can be killed the instant it is revoked.
- **Benefits**: Immediate revocation for incident response and offboarding, a full inventory of who is signed in, smaller tokens on the wire, and tighter control for regulated environments.
- **When**: Q2 2027.

## OpenID Federation 1.0
- **Goal**: Enable federated trust and [identity provider](https://www.abblix.com/en/docs/glossary-overview#identity-provider) chaining across organizational boundaries.
- **Action**: Implement the OpenID Federation 1.0 specification: trust relationships with other identity providers without manual configuration, automatic metadata discovery, and trust chain validation.
- **Benefits**: Simplified integration with multiple upstream identity providers, dynamic trust establishment without pre-configuration, support for multi-organization scenarios, and centralized authentication policy enforcement across federated environments.
- **When**: Q2 2027.
- **Reference**: [OpenID Federation 1.0](https://openid.net/specs/openid-federation-1_0.html)

:::info
We welcome your suggestions on our [Abblix GitHub page](https://github.com/Abblix/Oidc.Server). Looking forward to your proposals!
:::