.NET 7 Blocker - Method get_ServerSideSessions in type ApiAuthorizationDbContext from assembly IdentityServer does not have an implementation

[Alan468]

Which version of Duende BFF are you using?
6.2.1

Which version of .NET are you using?
.NET 7

Describe the bug / Log output/exception with stacktrace
We were advised to create seperate ticket for IdnetityServer to get more details regarding

Relevant MS AspNetCore ticekt dotnet/aspnetcore#46025

When trying to build .Net 7 (Angular and WebAPI )application we are getting

`13>Method "get_ServerSideSessions" in type "Microsoft.AspNetCore.ApiAuthorization.IdentityServer.ApiAuthorizationDbContext"1" from assembly "Microsoft.AspNetCore.ApiAuthorization.IdentityServer, Version=7.0.2.0, Culture=neutral, PublicKeyToken=adb9793829ddae60" does not have an implementation.)

13> ---> System.Reflection.ReflectionTypeLoadException: Unable to load one or more of the requested types.
13>Method "get_ServerSideSessions" in type "Microsoft.AspNetCore.ApiAuthorization.IdentityServer.ApiAuthorizationDbContext"1" from assembly "Microsoft.AspNetCore.ApiAuthorization.IdentityServer, Version=7.0.2.0, Culture=neutral, PublicKeyToken=adb9793829ddae60" does not have an implementation.

13> at System.Reflection.RuntimeModule.GetTypes(RuntimeModule module)
13> at Microsoft.AspNetCore.Mvc.Controllers.ControllerFeatureProvider.PopulateFeature(IEnumerable"1 parts, ControllerFeature feature)
13> at Microsoft.AspNetCore.Mvc.ApplicationParts.ApplicationPartManager.PopulateFeature[TFeature](TFeature feature)
13> at Microsoft.AspNetCore.Mvc.ApplicationModels.ControllerActionDescriptorProvider.GetControllerTypes()
13> at Microsoft.AspNetCore.Mvc.ApplicationModels.ControllerActionDescriptorProvider.GetDescriptors()
13> at Microsoft.AspNetCore.Mvc.ApplicationModels.ControllerActionDescriptorProvider.OnProvidersExecuting(ActionDescriptorProviderContext context)
13> at Microsoft.AspNetCore.Mvc.Infrastructure.DefaultActionDescriptorCollectionProvider.UpdateCollection()
13> at Microsoft.AspNetCore.Mvc.Infrastructure.DefaultActionDescriptorCollectionProvider.Initialize()
13> at Microsoft.AspNetCore.Mvc.Infrastructure.DefaultActionDescriptorCollectionProvider.GetChangeToken()
13> at Microsoft.Extensions.Primitives.ChangeToken.OnChange(Func"1 changeTokenProducer, Action changeTokenConsumer)
13> at Microsoft.AspNetCore.Mvc.Routing.ActionEndpointDataSourceBase.Subscribe()
13> at Microsoft.AspNetCore.Builder.ControllerEndpointRouteBuilderExtensions.GetOrCreateDataSource(IEndpointRouteBuilder endpoints)
13> at Microsoft.AspNetCore.Builder.ControllerEndpointRouteBuilderExtensions.MapControllerRoute(IEndpointRouteBuilder endpoints, String name, String pattern, Object defaults, Object constraints, Object dataTokens)
13> at HomePlanner.Server.Application.Program.Main(String[] args) in D:\PROJEKTY\HomePlanner\HomePlanner.Server\HomePlanner.Server.Application\Program.cs:line 57
13> at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
13> at System.Reflection.MethodInvoker.Invoke(Object obj, IntPtr* args, BindingFlags invokeAttr)
13>System.TypeLoadException: Method "get_ServerSideSessions" in type "Microsoft.AspNetCore.ApiAuthorization.IdentityServer.ApiAuthorizationDbContext"1" from assembly "Microsoft.AspNetCore.ApiAuthorization.IdentityServer, Version=7.0.2.0, Culture=neutral, PublicKeyToken=adb9793829ddae60" does not have an implementation.
13> --- End of inner exception stack trace ---
13> at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
13> at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
13> at System.Threading.Tasks.Task.Wait()
13> at NSwag.Commands.ServiceProviderResolver.GetServiceProviderWithHostFactoryResolver(Assembly assembly) in //src/NSwag.Commands/HostApplication.cs:line 158
13> at NSwag.Commands.ServiceProviderResolver.GetServiceProvider(Assembly assembly) in //src/NSwag.Commands/HostApplication.cs:line 70
13> at NSwag.Commands.Generation.AspNetCore.AspNetCoreToOpenApiGeneratorCommandEntryPoint.Process(String commandContent, String outputFile, String applicationName) in //src/NSwag.Commands/Commands/Generation/AspNetCore/AspNetCoreToOpenApiGeneratorCommandEntryPoint.cs:line 27
13> at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
13> at System.Reflection.MethodInvoker.Invoke(Object obj, IntPtr* args, BindingFlags invokeAttr)
13> --- End of inner exception stack trace ---
13> at System.Reflection.MethodInvoker.Invoke(Object obj, IntPtr* args, BindingFlags invokeAttr)
13> at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
13> at System.Reflection.MethodBase.Invoke(Object obj, Object[] parameters)
13> at NSwag.AspNetCore.Launcher.Program.Main(String[] args) in //src/NSwag.AspNetCore.Launcher/Program.cs:line 132
13>System.InvalidOperationException: Swagger generation failed with non-zero exit code "1".
13> at NSwag.Commands.Generation.AspNetCore.AspNetCoreToSwaggerCommand.RunAsync(CommandLineProcessor processor, IConsoleHost host) in //src/NSwag.Commands/Commands/Generation/AspNetCore/AspNetCoreToOpenApiCommand.cs:line 231
13> at NSwag.Commands.NSwagDocumentBase.GenerateSwaggerDocumentAsync() in //src/NSwag.Commands/NSwagDocumentBase.cs:line 275
13> at NSwag.Commands.NSwagDocument.ExecuteAsync() in //src/NSwag.Commands/NSwagDocument.cs:line 81
13> at NSwag.Commands.Document.ExecuteDocumentCommand.ExecuteDocumentAsync(IConsoleHost host, String filePath) in //src/NSwag.Commands/Commands/Document/ExecuteDocumentCommand.cs:line 85
13> at NSwag.Commands.Document.ExecuteDocumentCommand.RunAsync(CommandLineProcessor processor, IConsoleHost host) in //src/NSwag.Commands/Commands/Document/ExecuteDocumentCommand.cs:line 39
13> at NConsole.CommandLineProcessor.ProcessSingleAsync(String[] args, Object input)
13> at NConsole.CommandLineProcessor.ProcessAsync(String[] args, Object input)
13> at NSwag.Commands.NSwagCommandProcessor.ProcessAsync(String[] args) in //src/NSwag.Commands/NSwagCommandProcessor.cs:line 61`

We are using the latest versions of the packages (there is nothing to update)

<PackageReference Include="AutoMapper" Version="12.0.0" />
<PackageReference Include="AutoMapper.Collection" Version="9.0.0" />
<PackageReference Include="AutoMapper.Collection.EntityFrameworkCore" Version="9.0.0" />
<PackageReference Include="AutoMapper.Extensions.ExpressionMapping" Version="6.0.2" />
<PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="12.0.0" />

<PackageReference Include="Duende.IdentityServer" Version="6.2.0" />
<PackageReference Include="Duende.IdentityServer.AspNetIdentity" Version="6.2.0" />
<PackageReference Include="Duende.IdentityServer.EntityFramework" Version="6.2.0" />
<PackageReference Include="Duende.IdentityServer.Storage" Version="6.2.0" />
<PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.4.0" />     

<PackageReference Include="Microsoft.AspNetCore.ApiAuthorization.IdentityServer" Version="7.0.2" />
<PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="7.0.2" />
<PackageReference Include="Microsoft.AspNetCore.SpaProxy" Version="7.0.2" />
<PackageReference Include="Microsoft.EntityFrameworkCore" Version="7.0.2" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="7.0.2"/> 
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="7.0.0" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="7.0.0" />  
...

Current state of Microsoft.AspNetCore.ApiAuthorization.IdentityServer package is blocking upgrade to .Net 7 IdentityServer 6.2

As was pointed out .Net 7 needs AutoMapper 12 (1), newest IndentityServer (6.2.0) also has supports .Net 7 and uses AutoMapper 12 but at the same time they added that ServerSideSessions DbSet (2) which is not present in ApiAuthorizationDbContext of Microsoft.AspNetCore.ApiAuthorization.IdentityServer 7.0.0 (3)

I have tried to lower the versions of Duende.IdentityServer to 6.0.4 which is last version without ServerSideSessions but then I have to lower version of AutoMapper to 11 and that results in error ("violates the constraint of type parameter 'T'" (1)).

Information that we got from AspNetCore team
I would suggest in parallel raising this issue with the Identity Server team, as they might have a way to revert the breaking change in a future release and delay it until a major version. That would make future versions compatible with our package again.
dotnet/aspnetcore#46025

But would there be a way to make it work properly without usage of workaround mentioned in AspNetCore ticket?

1. MaxInteger[T](System.Collections.Generic.IEnumerable`1[T])' violates the constraint of type parameter 'T' exception LuckyPennySoftware/AutoMapper#3988
   [dotnet-sdk-7.0.100-preview.5.22257.3] MaxInteger[T](System.Collections.Generic.IEnumerable`1[T])' violates the constraint of type parameter 'T' exception error dotnet/runtime#69119
2. https://docs.duendesoftware.com/identityserver/v6/data/operational/sessions/
3. ApiAuthorizationDbContext.cs missing ServerSideSessions Patch dotnet/aspnetcore#45145

To Reproduce
Create application that uses
Duende.IdentityServer (and related) 6.2.0
Microsoft.AspNetCore.ApiAuthorization.IdentityServer (and related) 7.0.2
AutoMapper (and related) 12.0.0

Expected behavior
Application should build.
Method get_ServerSideSessions in type ApiAuthorizationDbContext from assembly IdentityServer does not have an implementation error should disappear

[Drol]

Well the error is not when building. It is a runtime error right?

[Alan468]

This error is occurring during the build

[josephdecock]

@Alan468 , we generally recommend that folks move away from those templates for several reasons.

While the architecture in the templates works, there are some disadvantages to the design presented in the template. There is an obvious complexity in using two different credential types in the single host (cookies and tokens). There are great pains taken in the template (hidden away in various extension methods and clever configuration in the DI system) to accept the access token for the API calls, but only accept the authentication cookie to the ASP.NET Identity Pages and the Duende IdentityServer endpoints.

Related to this, co-hosting your token server (i.e. Duende IdentityServer) with the application and API is simply not the recommended pattern. The intent of using a token server is to enable centralization of user authentication, which enables single sign-on for users. Co-hosting the token server with the client application (and API) is counter to that goal. Thus, the recommended approach is to host Duende IdentityServer (and then also the ASP.NET Identity Pages) in its own host separate from the app and API.

We describe this in a chapter in our docs here, along with a guide for converting to our recommended architecture.

[Drol]

Yeah well whatever. In our project it builds just fine with latest everything. But we get a runtime error.

[josephdecock]

Regardless of if this is a build or runtime error, it ultimately is Microsoft's package which we don't support. Either way, we do recommend for the above mentioned architectural reasons to migrate away from that package.