Interface IBackchannelAuthenticationUserNotificationService
- Namespace
- Fdyay.IdentityServer.Services
- Assembly
- Fdyay.IdentityServer.Core.dll
Tells a user that a client is waiting on them to approve something.
public interface IBackchannelAuthenticationUserNotificationServiceRemarks
The second of the two things a host must supply before CIBA can work, and the one that makes it a flow rather than a queue. Every other way a user authorizes a client here begins with that user already looking at something — a redirect they followed, a code on a screen in front of them. A backchannel request begins with nobody there, so unless the server can reach out, the request sits until it expires and the client polls the whole time for an answer that was never going to come.
No default implementation, deliberately. How a deployment reaches a person — a push notification, an SMS, a
message in an app they already have open — is exactly the part this library cannot know, and a default that
did nothing would turn "your host has not finished wiring CIBA up" into "CIBA is slow today". That is why
UseIdentityServer() refuses to start when the endpoint is enabled and this is missing, rather than
discovering it on the first request.
It is called before the client is answered, so a host that cannot reach the user fails the request instead of
handing back an auth_req_id nobody will ever act on.
Send the user to your approval page with InternalId — and never
with the auth_req_id, which is the client's bearer credential for the tokens and has no business in a
link, a browser history or a Referer header. There is no option here naming that page's path: nothing
in this server builds the link, so a setting for it would be one more thing configured and never read.
Methods
NotifyAsync(BackChannelAuthenticationRequest, CancellationToken)
Reaches the user named by request.
Task NotifyAsync(BackChannelAuthenticationRequest request, CancellationToken cancellationToken = default)Parameters
requestBackChannelAuthenticationRequestcancellationTokenCancellationToken
Returns
Remarks
Throwing fails the client's request, which is the honest outcome: a request the user will not hear about cannot be approved, and saying so now is better than a client polling for the next five minutes.