Table of Contents

Class IdentityServerTools

Namespace
Fdyay.IdentityServer.Services
Assembly
Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class IdentityServerTools : IIdentityServerTools
Inheritance
IdentityServerTools
Implements
Inherited Members

Constructors

IdentityServerTools(IIssuerNameService, ITokenCreationService, IClientStore, TimeProvider) 

public IdentityServerTools(IIssuerNameService issuerNameService, ITokenCreationService tokens, IClientStore clients, TimeProvider time)

Parameters

issuerNameService IIssuerNameService
tokens ITokenCreationService
clients IClientStore
time TimeProvider

Remarks

The constructor this had before 0.150.0, kept. The client store is no longer consulted — no client is looked up, as Duende's looks none up — and with no options given the defaults apply, so the static audience is not added.

IdentityServerTools(IIssuerNameService, ITokenCreationService, TimeProvider, IOptions<IdentityServerOptions>) 

[ActivatorUtilitiesConstructor]
public IdentityServerTools(IIssuerNameService issuerNameService, ITokenCreationService tokens, TimeProvider time, IOptions<IdentityServerOptions> options)

Parameters

issuerNameService IIssuerNameService
tokens ITokenCreationService
time TimeProvider
options IOptions<IdentityServerOptions>

Remarks

Duende's four, new in 0.150.0 beside the one taking the client store, and the one the container builds — so the options are the server's.

Methods

IssueClientJwtAsync(string, int, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<Claim>?, CancellationToken)

An access token naming a client, as though it had asked for one. Duende's.

public Task<string> IssueClientJwtAsync(string clientId, int lifetime, IEnumerable<string>? audiences = null, IEnumerable<string>? scopes = null, IEnumerable<Claim>? additionalClaims = null, CancellationToken cancellationToken = default)

Parameters

clientId string
lifetime int
audiences IEnumerable<string>
scopes IEnumerable<string>
additionalClaims IEnumerable<Claim>
cancellationToken CancellationToken

Returns

Task<string>

Remarks

The claims a client-credentials token carries — client_id, the scopes, the audiences — without the client having to authenticate for it. Duende 8.0.1's, measured: the claims given, then client_id and the scopes; the static {issuer}/resources audience when EmitStaticAudienceClaim is on, then the audiences given; issued under the server's issuer as an access token.

The client is not looked up, as Duende's is not: the caller names it and answers for it, as for an issuer. Breaking in 0.150.0: it was looked up and refused when unknown or disabled.

In this server's order, kept; Duende's — the token third, the scopes before the audiences — is the overload beside it.

Exceptions

InvalidOperationException

There is no request in flight and no configured issuer.

IssueClientJwtAsync(string, int, CancellationToken, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<Claim>?)

An access token naming a client, in Duende's argument order.

[SuppressMessage("Design", "CA1068:CancellationToken parameters must come last", Justification = "Duende's order, which a host moving off Duende compiles against.")]
public Task<string> IssueClientJwtAsync(string clientId, int lifetime, CancellationToken cancellationToken, IEnumerable<string>? scopes = null, IEnumerable<string>? audiences = null, IEnumerable<Claim>? additionalClaims = null)

Parameters

clientId string
lifetime int
cancellationToken CancellationToken
scopes IEnumerable<string>
audiences IEnumerable<string>
additionalClaims IEnumerable<Claim>

Returns

Task<string>

Remarks

Duende 8.0.1's signature, offered beside this server's order (decided 2026-10-14), so a host moving off Duende compiles as it is. The token is required, unlike Duende's, so a call in this server's order is never read as this one; a call naming cancellationToken with every other optional argument named or left out matches both, and passes one argument positionally. The default body answers through the other, so an implementation of this interface written before 0.150.0 answers it too.

IssueJwtAsync(int, IEnumerable<Claim>, CancellationToken)

A JWT issued by this server, carrying claims.

public Task<string> IssueJwtAsync(int lifetime, IEnumerable<Claim> claims, CancellationToken cancellationToken = default)

Parameters

lifetime int

Seconds until it expires.

claims IEnumerable<Claim>

The claims to carry. iss, aud, exp, nbf, iat and jti are the server's.

cancellationToken CancellationToken

Cancels the signing-key lookup.

Returns

Task<string>

Exceptions

InvalidOperationException

There is no request in flight and no configured issuer.

IssueJwtAsync(int, string, IEnumerable<Claim>, CancellationToken)

The same, issued under an issuer the caller names.

public Task<string> IssueJwtAsync(int lifetime, string issuer, IEnumerable<Claim> claims, CancellationToken cancellationToken = default)

Parameters

lifetime int
issuer string
claims IEnumerable<Claim>
cancellationToken CancellationToken

Returns

Task<string>

Remarks

For a host that issues under an identity other than the one it serves discovery on. The issuer is not checked against anything: naming it is the caller taking responsibility for it.

IssueJwtAsync(int, string, string, IEnumerable<Claim>, CancellationToken)

The same, as a token of the type the caller names. Duende's.

public Task<string> IssueJwtAsync(int lifetime, string issuer, string tokenType, IEnumerable<Claim> claims, CancellationToken cancellationToken = default)

Parameters

lifetime int

Seconds until it expires.

issuer string

The issuer to put in iss, taken as given and not checked against anything.

tokenType string

What the token is, which decides its typ header as for the tokens the endpoints issue: access_token is AccessTokenJwtType, logout_token is logout+jwt, and any other type is JWT, as Duende's are. The overloads without it issue access_token.

claims IEnumerable<Claim>

The claims to carry. iss, aud, exp, nbf, iat and jti are the server's.

cancellationToken CancellationToken

Cancels the signing-key lookup.

Returns

Task<string>