Table of Contents

Class OidcReturnUrlParser

Namespace
Fdyay.IdentityServer.Services
Assembly
Fdyay.IdentityServer.AspNetCore.dll

The return URLs of the OpenID Connect authorize endpoint.

public sealed class OidcReturnUrlParser : IReturnUrlParser
Inheritance
OidcReturnUrlParser
Implements
Inherited Members

Remarks

Lifted out of DefaultIdentityServerInteractionService; now one protocol's answer among however many the host has registered. Changed in 0.164.0, as Duende 8.0.1's OidcReturnUrlParser, measured: the request is validated again by IAuthorizeRequestValidator, with the session's user, and the AuthorizationRequest is built from the validated request, so what a custom validator changes is what the pages read and a request it refuses is described as none. Until then the parser rebuilt the request from the query string and checked only the client and the redirect URI.

Constructors

OidcReturnUrlParser(IClientStore, IResourceValidator, IHttpContextAccessor, IPushedAuthorizationRequestStore, IRequestObjectValidator, TimeProvider, IRedirectUriValidator?) 

public OidcReturnUrlParser(IClientStore clients, IResourceValidator resources, IHttpContextAccessor httpContextAccessor, IPushedAuthorizationRequestStore pushedRequests, IRequestObjectValidator requestObjects, TimeProvider time, IRedirectUriValidator? redirectUris = null)

Parameters

clients IClientStore
resources IResourceValidator
httpContextAccessor IHttpContextAccessor
pushedRequests IPushedAuthorizationRequestStore
requestObjects IRequestObjectValidator
time TimeProvider
redirectUris IRedirectUriValidator

Remarks

The constructor before 0.149.0, kept. The request is validated by this server's own validator, built from what is given here with the default options and no custom validator, and the user is the HTTP request's.

OidcReturnUrlParser(IClientStore, IResourceValidator, IHttpContextAccessor, IPushedAuthorizationRequestStore, IRequestObjectValidator, TimeProvider, IRedirectUriValidator?, IOptions<IdentityServerOptions>?)

With the server's options, so UserInteraction.AllowOriginInReturnUrl is honoured (0.149.0).

public OidcReturnUrlParser(IClientStore clients, IResourceValidator resources, IHttpContextAccessor httpContextAccessor, IPushedAuthorizationRequestStore pushedRequests, IRequestObjectValidator requestObjects, TimeProvider time, IRedirectUriValidator? redirectUris, IOptions<IdentityServerOptions>? options)

Parameters

clients IClientStore
resources IResourceValidator
httpContextAccessor IHttpContextAccessor
pushedRequests IPushedAuthorizationRequestStore
requestObjects IRequestObjectValidator
time TimeProvider
redirectUris IRedirectUriValidator
options IOptions<IdentityServerOptions>

Remarks

Kept beside the one taking the validator: the request is validated by this server's own validator, built from what is given here with no custom validator, and the user is the HTTP request's.

OidcReturnUrlParser(IClientStore, IResourceValidator, IHttpContextAccessor, IPushedAuthorizationRequestStore, IRequestObjectValidator, TimeProvider, IRedirectUriValidator?, IOptions<IdentityServerOptions>?, IAuthorizeRequestValidator, IUserSession)

With the authorize request validator and the user's session, as Duende's parser takes them (0.164.0).

public OidcReturnUrlParser(IClientStore clients, IResourceValidator resources, IHttpContextAccessor httpContextAccessor, IPushedAuthorizationRequestStore pushedRequests, IRequestObjectValidator requestObjects, TimeProvider time, IRedirectUriValidator? redirectUris, IOptions<IdentityServerOptions>? options, IAuthorizeRequestValidator validator, IUserSession userSession)

Parameters

clients IClientStore

The registered clients.

resources IResourceValidator

Validates the requested scopes and resources.

httpContextAccessor IHttpContextAccessor

The request the return URL is judged against.

pushedRequests IPushedAuthorizationRequestStore

Where a pushed request's parameters are.

requestObjects IRequestObjectValidator

Resolves a request object.

time TimeProvider

The clock a pushed request expires by.

redirectUris IRedirectUriValidator

Which redirect URIs a client may use.

options IOptions<IdentityServerOptions>

The server's options.

validator IAuthorizeRequestValidator

The authorize request validator the endpoint asks, asked again for every parse.

userSession IUserSession

The signed-in user, handed to validator.

Remarks

The one the container chooses. clients, resources and redirectUris are the validator's to use and are not read here; they keep this overload a superset of the others.

Methods

IsValidReturnUrl(string?) 

public bool IsValidReturnUrl(string? returnUrl)

Parameters

returnUrl string

Returns

bool

Remarks

Under AllowOriginInReturnUrl, an absolute URL on this server's origin is judged without it, as Duende's parser judges it.

ParseAsync(string?, CancellationToken)

The authorization request the return URL names, or null when it names none this server would answer.

public Task<IAuthenticationContext?> ParseAsync(string? returnUrl, CancellationToken cancellationToken = default)

Parameters

returnUrl string
cancellationToken CancellationToken

Returns

Task<IAuthenticationContext>

Remarks

Duende 8.0.1's, measured: the return URL's parameters and the session's user go to the authorize request validator as the authorize endpoint's would, and a refusal is null. Here, as at the endpoint, a pushed request and a request object are resolved first — this server's validator reads neither — and a client that must push or sign and did not is refused, as Duende's validator refuses it.

What the page is told is the validated request's, as Duende's AuthorizationRequest constructor takes it: DisplayMode, LoginHint, UiLocales, the idp: and tenant: hints, AcrValues without them (GetAcrValues), the validated resources and the parameters. Ours: PromptModes is the values still to be acted on, where Duende's is the values the client sent — a login page told prompt=login on its own return would ask the user to sign in again — and RequestObjectValues is a map of the signed values, where Duende's is the claims.