Table of Contents

Class LocalApiAuthenticationHandler

Namespace
Fdyay.IdentityServer.Hosting
Assembly
Fdyay.IdentityServer.AspNetCore.dll

Authenticates a request to an API this server hosts, against a token this server issued.

public sealed class LocalApiAuthenticationHandler : AuthenticationHandler<LocalApiAuthenticationOptions>, IAuthenticationHandler
Inheritance
LocalApiAuthenticationHandler
Implements
Inherited Members

Remarks

No network and no discovery: the token is validated in-process by the same ITokenValidator the protocol endpoints use, against the same keys, with the same issuer. That is the whole point of the scheme — a host adding an API beside the identity server should not have to point a JWT handler back at the server it is already running inside.

It is a resource server, so it runs ISenderConstraintValidator. Without that this would be the third place a sender-constrained token was accepted from whoever happened to be holding it, after the two 0.45.0 closed — and the first of them built after the rule existed.

Constructors

LocalApiAuthenticationHandler(IOptionsMonitor<LocalApiAuthenticationOptions>, ILoggerFactory, UrlEncoder, ITokenValidator, ISenderConstraintValidator, IIssuerNameService)

Creates the handler, as the authentication system resolves it.

public LocalApiAuthenticationHandler(IOptionsMonitor<LocalApiAuthenticationOptions> options, ILoggerFactory logger, UrlEncoder encoder, ITokenValidator tokens, ISenderConstraintValidator senderConstraint, IIssuerNameService issuerNameService)

Parameters

options IOptionsMonitor<LocalApiAuthenticationOptions>

The scheme's options.

logger ILoggerFactory

Creates the handler's logger.

encoder UrlEncoder

The URL encoder the base handler uses.

tokens ITokenValidator

Validates the access token in-process, against this server's keys.

senderConstraint ISenderConstraintValidator

Checks the caller proves possession of the key a sender-constrained token is bound to.

issuerNameService IIssuerNameService

Names this server as the issuer the token must come from.

Methods

HandleAuthenticateAsync()

Authenticates the request's access token: no result when there is none or its scheme is not one TokenMode takes; a failure when it is not valid, fails its sender constraint or lacks ExpectedScope; otherwise a ticket for its claims.

protected override Task<AuthenticateResult> HandleAuthenticateAsync()

Returns

Task<AuthenticateResult>

The result of authenticating the request.

HandleChallengeAsync(AuthenticationProperties)

Answers a refused or absent token the way a resource server does.

protected override Task HandleChallengeAsync(AuthenticationProperties properties)

Parameters

properties AuthenticationProperties

Returns

Task

Remarks

The challenge names the scheme the token should have come under rather than this handler's own scheme name, which is an internal label: a client reading IdentityServerAccessToken off a WWW-Authenticate has been told something it cannot act on.