Class ClientCredentialsTokenService

Namespace

Fdyay.AccessTokenManagement

Assembly

Fdyay.AccessTokenManagement.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class ClientCredentialsTokenService : IClientCredentialsTokenService, IDisposable

Inheritance

object

ClientCredentialsTokenService

Implements

IClientCredentialsTokenService

IDisposable

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

ClientCredentialsTokenService(IHttpClientFactory, IOptionsMonitor<ClientCredentialsClient>, TimeProvider)

Creates the service.

public ClientCredentialsTokenService(IHttpClientFactory httpClientFactory, IOptionsMonitor<ClientCredentialsClient> clients, TimeProvider time)

Parameters

httpClientFactory IHttpClientFactory

Supplies the client each token request goes out on.

clients IOptionsMonitor<ClientCredentialsClient>

The registered clients, by name.

time TimeProvider

The clock cached tokens are judged against.

Fields

TokenRequestHttpClientName

The client the token request itself goes out on when a client names none of its own.

public const string TokenRequestHttpClientName = "Fdyay.AccessTokenManagement.TokenRequest"

Field Value

string

Remarks

Named, rather than the unnamed default client this used to resolve. The empty name is every default an HttpClientHandler has, and one of them is AllowAutoRedirect: a token endpoint answering 302 had the request followed to wherever it pointed, and because the Authorization header is only stripped when a redirect leaves the origin, a redirect to another path on the same host presented the client secret to a URL the host never configured. A host that sets HttpClientName still gets exactly the client it named, and owns that client's policy — which is what the option is for.

Methods

Dispose()

Disposes what the token requests still in flight hold; it does not cancel them.

public void Dispose()

Evict(ClientCredentialsClientName)

Discards the cached token, so the next request obtains a fresh one.

public void Evict(ClientCredentialsClientName clientName)

Parameters

clientName ClientCredentialsClientName

Remarks

For the case the cache cannot see: a resource server rejecting a token this client still believes in — revoked, or signed by a key that has rotated.

GetAccessTokenAsync(ClientCredentialsClientName, CancellationToken)

The current token for a registered client, obtaining one if the cache cannot serve it.

public Task<ClientCredentialsToken> GetAccessTokenAsync(ClientCredentialsClientName clientName, CancellationToken cancellationToken = default)

Parameters

clientName ClientCredentialsClientName

cancellationToken CancellationToken

Returns

Task<ClientCredentialsToken>