Table of Contents

Class LocalApiAuthenticationOptions

Namespace
Fdyay.IdentityServer.Hosting
Assembly
Fdyay.IdentityServer.AspNetCore.dll

What the local API handler gives a host a say over.

public sealed class LocalApiAuthenticationOptions : AuthenticationSchemeOptions
Inheritance
LocalApiAuthenticationOptions
Inherited Members

Remarks

Deliberately small. A local API is an API this server hosts itself, so almost everything a general-purpose JWT handler makes configurable — the authority, the signing keys, the issuer, the clock skew — is already settled by the server the handler is running inside, and offering it twice invites the two to disagree.

Constructors

LocalApiAuthenticationOptions()

Creates the options with a LocalApiAuthenticationEvents that changes nothing.

public LocalApiAuthenticationOptions()

Properties

Events

The host's hook for shaping the principal the API sees.

public LocalApiAuthenticationEvents Events { get; set; }

Property Value

LocalApiAuthenticationEvents

ExpectedScope

The scope a token has to carry. Defaults to IdentityServerApi.

public string ExpectedScope { get; set; }

Property Value

string

Remarks

Required, and there is no way to say "any token this server issued". That would be a door opened by every token in the deployment — including one minted for an unrelated API, by a client the host never meant to let near its administration surface. A host that genuinely wants it can write four lines of its own handler; it will not get it here by leaving a property empty.

SaveToken

Whether the token is kept so the API can read it back. Defaults to true.

public bool SaveToken { get; set; }

Property Value

bool

Remarks

On by default because a local API calling on to something else is the ordinary case, and a token it cannot reach is a token it will be handed a second way instead.

Read it back by naming this scheme: HttpContext.GetTokenAsync(IdentityServerConstants.LocalApi.AuthenticationScheme, "access_token"). The overload without a scheme reads the default authenticate scheme, which in any host that also serves this server's own pages is a browser cookie holding no access token — so it answers null, and it answers null in exactly the deployment this option exists for.

TokenMode

Which schemes a token is taken under. Defaults to DPoPAndBearer.

public LocalApiTokenMode TokenMode { get; set; }

Property Value

LocalApiTokenMode

Remarks

Duende's defaults to BearerOnly. This handler has taken a token under either scheme since 0.45.0, so its default stays both: a default of Bearer only would turn away every caller holding a token bound to its key. Whatever the mode, a token bound to a key is refused under Bearer — the mode decides which schemes are read, never whether a binding is held to.

Methods

Validate()

Validates the options as the base class does, and requires an ExpectedScope.

public override void Validate()

Exceptions

ArgumentException

ExpectedScope is null or empty.