Interface IIdentityServerTools

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Issues a token signed by this server, for a host that is not answering a protocol request.

public interface IIdentityServerTools

Remarks

Everything else here mints a token because a client asked for one through an endpoint. A host sometimes needs one for its own reasons — a signed callback URL, a short-lived credential for a job it is about to start, a token for an internal caller that has no client registration to authenticate with — and until 0.25.0 had to reach past this library to its signing key to get one, which is how two issuers and two key rotations start.

These always produce a **JWT**. A client registered for reference access tokens gets a JWT from IssueClientJwtAsync(string, int, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<Claim>?, CancellationToken) and not a handle: the token endpoint's reference-token path exists so a resource server can introspect a token this server still controls, and a caller asking for a JWT by name is not asking for that.

Methods

IssueClientJwtAsync(string, int, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<Claim>?, CancellationToken)

An access token naming a client, as though it had asked for one. Duende's.

Task<string> IssueClientJwtAsync(string clientId, int lifetime, IEnumerable<string>? audiences = null, IEnumerable<string>? scopes = null, IEnumerable<Claim>? additionalClaims = null, CancellationToken cancellationToken = default)

Parameters

clientId string

lifetime int

audiences IEnumerable<string>

scopes IEnumerable<string>

additionalClaims IEnumerable<Claim>

cancellationToken CancellationToken

Returns

Task<string>

Remarks

The claims a client-credentials token carries — client_id, the scopes, the audiences — without the client having to authenticate for it. Duende 8.0.1's, measured: the claims given, then client_id and the scopes; the static {issuer}/resources audience when EmitStaticAudienceClaim is on, then the audiences given; issued under the server's issuer as an access token.

The client is not looked up, as Duende's is not: the caller names it and answers for it, as for an issuer. Breaking in 0.150.0: it was looked up and refused when unknown or disabled.

In this server's order, kept; Duende's — the token third, the scopes before the audiences — is the overload beside it.

Exceptions

InvalidOperationException

There is no request in flight and no configured issuer.

IssueClientJwtAsync(string, int, CancellationToken, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<Claim>?)

An access token naming a client, in Duende's argument order.

[SuppressMessage("Design", "CA1068:CancellationToken parameters must come last", Justification = "Duende's order, which a host moving off Duende compiles against.")]
Task<string> IssueClientJwtAsync(string clientId, int lifetime, CancellationToken cancellationToken, IEnumerable<string>? scopes = null, IEnumerable<string>? audiences = null, IEnumerable<Claim>? additionalClaims = null)

Parameters

clientId string

lifetime int

cancellationToken CancellationToken

scopes IEnumerable<string>

audiences IEnumerable<string>

additionalClaims IEnumerable<Claim>

Returns

Task<string>

Remarks

Duende 8.0.1's signature, offered beside this server's order (decided 2026-10-14), so a host moving off Duende compiles as it is. The token is required, unlike Duende's, so a call in this server's order is never read as this one; a call naming cancellationToken with every other optional argument named or left out matches both, and passes one argument positionally. The default body answers through the other, so an implementation of this interface written before 0.150.0 answers it too.

IssueJwtAsync(int, IEnumerable<Claim>, CancellationToken)

A JWT issued by this server, carrying claims.

Task<string> IssueJwtAsync(int lifetime, IEnumerable<Claim> claims, CancellationToken cancellationToken = default)

Parameters

lifetime int

Seconds until it expires.

claims IEnumerable<Claim>

The claims to carry. iss, aud, exp, nbf, iat and jti are the server's.

cancellationToken CancellationToken

Cancels the signing-key lookup.

Returns

Task<string>

Exceptions

InvalidOperationException

There is no request in flight and no configured issuer.

IssueJwtAsync(int, string, IEnumerable<Claim>, CancellationToken)

The same, issued under an issuer the caller names.

Task<string> IssueJwtAsync(int lifetime, string issuer, IEnumerable<Claim> claims, CancellationToken cancellationToken = default)

Parameters

lifetime int

issuer string

claims IEnumerable<Claim>

cancellationToken CancellationToken

Returns

Task<string>

Remarks

For a host that issues under an identity other than the one it serves discovery on. The issuer is not checked against anything: naming it is the caller taking responsibility for it.

IssueJwtAsync(int, string, string, IEnumerable<Claim>, CancellationToken)

The same, as a token of the type the caller names. Duende's.

Task<string> IssueJwtAsync(int lifetime, string issuer, string tokenType, IEnumerable<Claim> claims, CancellationToken cancellationToken = default)

Parameters

lifetime int

Seconds until it expires.

issuer string

The issuer to put in iss, taken as given and not checked against anything.

tokenType string

What the token is, which decides its typ header as for the tokens the endpoints issue: access_token is AccessTokenJwtType, logout_token is logout+jwt, and any other type is JWT, as Duende's are. The overloads without it issue access_token.

claims IEnumerable<Claim>

The claims to carry. iss, aud, exp, nbf, iat and jti are the server's.

cancellationToken CancellationToken

Cancels the signing-key lookup.

Returns

Task<string>