When will the request limit be enabled?

[skatanski]

IdentityServer version

7.1.0

.NET version

net 8

Description

We are getting the log entry stating that there's a 500 request limit (not yet enabled) when there's no valid license. There's information that such limit will be enforced in future Identity Server versions. Our dev and staging envs do not currently have license mounted, it will take some time to provision the license through our tools. I don't want to get blindsided and miss this change since it could have an impact on our work.

Does one of the newer versions like 7.1.1 or the RCs have this feature enabled? I could not find anything about it in the Release notes. I'm concerned I'm gonna miss that information and update the package. We want to keep updating packages as soon as they are released to stay on top of any vulnerabilities. If this is not yet enabled in any of the newer version, can there be clear communication when it will be enabled?

Reproduction steps

No response

Expected behavior

No response

Logs

No response

Additional context

No response

[maartenba]

Hi @skatanski - we currently do not enforce these, and we will communicate on our channels (release notes and blog) when we plan to do so.

We're soliciting feedback at this point:

• Is this limit reasonable for dev work?
• Is this OK for dev/test/.... environments (note you can always use the production key in those, this is allowed)
• Any other feedback on this potential change

Thoughts very much welcome!

[skatanski]

Thanks @maartenba
Our staging Identity Server instance gets ~160 rpms average. Our dev instance around 7 rpm average. Both are above the limit. Doesn't make sense to implement pod restarts to run that often, so we'd need to mount the license in non-prod pods as well.

[maartenba]

Thanks for the insight! This also reflects our current docs: https://docs.duendesoftware.com/identityserver/v7/fundamentals/license_key/#trial-mode

[skatanski]

@maartenba in your last response you've proposed you could generate 2 keys using same license (somehow I can't find it now). Would such keys be tied to the same license lifetime - meaning, when we renew our license ~ year end we'd get 3 keys instead of one? Thanks

[maartenba]

That was a thought I had but wanted to keep it vague first to see what your ideal scenario would be :-)

My idea was that there could be an option to generate "secondary" licenses tied to the main one, which you could use on different environments. A license is not a "secret" though, so sharing between environments should also work (even today).

What would be your ideal scenario to get those secondary environments provisioned with a license key?

[skatanski]

Thanks we've had a discussion and decided on a best solution for us. I don't think we will need further help on this and hopefully whenever you guys decide to release the change that enforces the request limit it will be well highlighted in the release notes. Thanks again!