Class BackChannelAuthenticationRequest
- Namespace
- Fdyay.IdentityServer.Models
- Assembly
- Fdyay.IdentityServer.Core.dll
A pending backchannel authentication request: what a client asked for on a user's behalf, and what that user has decided about it so far (OpenID Connect CIBA Core 1.0).
public sealed class BackChannelAuthenticationRequest- Inheritance
-
BackChannelAuthenticationRequest
- Inherited Members
Remarks
Reached by two different keys, for the same reason DeviceCode is. The client polls with the
auth_req_id it was given, and the user answers from a screen that has never seen that value — so the
store has to find one record from either the client's handle or the internal id the approval surface works in.
The two are kept apart deliberately rather than for storage convenience. The auth_req_id is a bearer
credential: whoever holds it collects the tokens when the request is approved. It belongs to the client and
travels over an authenticated back channel, and it must not end up in a URL a browser will keep in its
history, put in a Referer header, or hand to a page the user was talked into opening.
The subject is resolved when the request is made, not when it is answered. That is what makes the approval surface able to check that the person answering is the person the client named — a request approvable by whoever happens to be signed in would let a client name one user and be authorized by another.
Properties
AuthenticationContextReferenceClasses
The authentication context classes the client asked for (acr_values), in its order of preference, once
each, without the Tenant and IdP hints.
public ICollection<string> AuthenticationContextReferenceClasses { get; set; }Property Value
Remarks
Carried, not enforced, as Duende carries it: what it takes to authenticate somebody to a given class is the host's to decide, and this is where the host's notifier learns what was asked — a class that means "with a second factor" is a reason to reach the user through an app that can ask for one. A list rather than a set, because the order is the client's preference.
AuthenticationRequestId
The auth_req_id the client was issued, which is how the client names this request.
public string AuthenticationRequestId { get; set; }Property Value
Remarks
Carried on the record as well as being the key it is stored under, because a ping callback has to name the request in the client's own terms and the approval surface only ever holds the internal id. Without it the notification would be sent from a place that cannot say which request it is about.
It stays the store's key too — StoreAsync still takes it, and both store implementations index on
it — so this is the record knowing its own handle rather than a second source of truth for the lookup.
AuthorizedScopes
The scopes the user actually granted. Empty on a completed request means the user declined.
public ICollection<string> AuthorizedScopes { get; set; }Property Value
BindingMessage
The human-readable string the client and the user compare, when the client sent one (CIBA Core §7.1).
public string? BindingMessage { get; set; }Property Value
Remarks
What makes the flow safe to answer at all. The user is approving on a device that is not the one asking, so this is the only thing that ties the request on their screen to the transaction in front of them — an agent reads it out, and a request carrying a different string is somebody else's.
ClientId
The client that started the request.
public string ClientId { get; set; }Property Value
ClientNotificationToken
The token the client gave us to authenticate the callback with, when it asked for one (CIBA Core §7.1).
public string? ClientNotificationToken { get; set; }Property Value
Remarks
Kept on the request rather than read from the client's registration, because it is per-request: the client mints one for each request so that a notification arriving at its endpoint identifies which of its own requests was answered. Null for a polling client, which gets no callback.
CreationTime
When the request was created (UTC).
public DateTime CreationTime { get; set; }Property Value
Description
The name the user gave this grant when approving it, for their list of grants. Duende's.
public string? Description { get; set; }Property Value
Remarks
From the approval's ConsentResponse.Description, as the consent screen's reaches the consent it records.
IdP
The identity provider the request named with an idp: entry in acr_values, if it named one.
public string? IdP { get; set; }Property Value
InternalId
The id the approval surface works in, and the key this record is updated and removed by.
public string InternalId { get; set; }Property Value
Interval
The minimum seconds between polls that this client was told to wait, when it started.
public int Interval { get; set; }Property Value
Remarks
Recorded rather than read back from configuration when a poll arrives. It is what this client was
actually told, and a host that shortens the configured interval afterwards would otherwise begin
answering slow_down to a client polling at exactly the rate this server gave it.
IsComplete
Whether the user has finished deciding. False means the client should keep polling.
public bool IsComplete { get; set; }Property Value
Lifetime
How long the user has to answer, in seconds.
public int Lifetime { get; set; }Property Value
Properties
Custom parameters a custom validator accepted when the request was made. Duende's.
public IDictionary<string, string> Properties { get; set; }Property Value
Remarks
Copied from ValidatedBackchannelAuthenticationRequest.Properties when the request is stored, and handed to the
approval page and the user notification service with the rest of the request, which is what they are for.
RequestedResourceIndicators
The API the request named as a resource indicator (RFC 8707), if it named one.
public ICollection<string> RequestedResourceIndicators { get; set; }Property Value
Remarks
A collection, as on AuthorizationCode, though one indicator is accepted. Carried to the token request that redeems this one, and from there to the refresh token, so every token the grant yields is held to the API it was asked for.
RequestedScopes
The scopes the client asked for.
public ICollection<string> RequestedScopes { get; set; }Property Value
SessionId
The session the answer was given in.
public string? SessionId { get; set; }Property Value
Subject
The user who answered, as they were signed in when they did. Duende's.
[JsonConverter(typeof(ClaimsPrincipalLiteConverter))]
public ClaimsPrincipal? Subject { get; set; }Property Value
Remarks
Duende 8.0.1's CompleteLoginRequestAsync, measured: a clone of the approving user's principal, with
auth_time (now) and idp (local) added when it has none — so the tokens collected carry the
sign-in's auth_time, idp, amr and acr, and the profile service is asked with every claim
of it. Written as Duende's ClaimsPrincipalLite inside the stored request's JSON. Null until the user
answers, and on a request answered before 0.160.0, whose subject is SubjectId alone, as it was.
SubjectId
The subject the client asked to have authenticated, as the host's validator resolved it.
public string SubjectId { get; set; }Property Value
Tenant
The tenant the request named with a tenant: entry in acr_values, if it named one.
public string? Tenant { get; set; }