Class DefaultClaimsService

Namespace

Fdyay.IdentityServer.Services.Tokens

Assembly

Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public class DefaultClaimsService : IClaimsService

Inheritance

object

DefaultClaimsService

Implements

IClaimsService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's DefaultClaimsService, measured: the subject's claims come from two protected virtual steps, GetStandardSubjectClaims(ClaimsPrincipal) and GetOptionalClaims(ClaimsPrincipal), and what the profile service is asked for and may give passes FilterRequestedClaimTypes(IEnumerable<string>) and FilterProtocolClaims(IEnumerable<Claim>), in Duende's order. A host with a rule of its own overrides that step and keeps the rest.

Where ours differs: the two methods that run the steps are not virtual, and the protocol claim types are held back from the profile service after either filter step has run — an override may filter more, never less, so a profile service's scope cannot widen a token, nor its cnf or sid rebind one.

Constructors

DefaultClaimsService(IProfileService)

A claims service asking profileService for the user's claims.

public DefaultClaimsService(IProfileService profileService)

Parameters

profileService IProfileService

The profile service; available to a derived class as Profile.

Properties

Profile

The profile service asked for the user's claims. Duende's.

protected IProfileService Profile { get; }

Property Value

IProfileService

Methods

FilterProtocolClaims(IEnumerable<Claim>)

The claims the profile service issued, less the protocol claims. Duende's step.

protected virtual IEnumerable<Claim> FilterProtocolClaims(IEnumerable<Claim> claims)

Parameters

claims IEnumerable<Claim>

Returns

IEnumerable<Claim>

Remarks

An override may drop more; whatever it returns is held to the protocol claim types again.

FilterRequestedClaimTypes(IEnumerable<string>)

The claim types the profile service is asked for, less the protocol claim types. Duende's step.

protected virtual IEnumerable<string> FilterRequestedClaimTypes(IEnumerable<string> claimTypes)

Parameters

claimTypes IEnumerable<string>

Returns

IEnumerable<string>

Remarks

An override may drop more; whatever it returns is held to the protocol claim types again.

GetAccessTokenClaimsAsync(TokenCreationRequest, CancellationToken)

Gets the claims for an access token.

public Task<IReadOnlyCollection<Claim>> GetAccessTokenClaimsAsync(TokenCreationRequest request, CancellationToken cancellationToken = default)

Parameters

request TokenCreationRequest

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<Claim>>

GetIdentityTokenClaimsAsync(TokenCreationRequest, CancellationToken)

Gets the claims for an identity token.

public Task<IReadOnlyCollection<Claim>> GetIdentityTokenClaimsAsync(TokenCreationRequest request, CancellationToken cancellationToken = default)

Parameters

request TokenCreationRequest

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<Claim>>

GetOptionalClaims(ClaimsPrincipal)

The sign-in's other facts, when it has them: acr, and act. Duende's step.

protected virtual IEnumerable<Claim> GetOptionalClaims(ClaimsPrincipal subject)

Parameters

subject ClaimsPrincipal

Returns

IEnumerable<Claim>

Remarks

act is ours (RFC 8693 §4.1): who acted for this subject is a fact about how the token was obtained, the same class of claim as amr and idp, and its value type survives the copy, which keeps it a JSON object.

GetStandardSubjectClaims(ClaimsPrincipal)

The claims every token about a user carries: sub, and auth_time, idp and each amr from the sign-in. Duende's step.

protected virtual IEnumerable<Claim> GetStandardSubjectClaims(ClaimsPrincipal subject)

Parameters

subject ClaimsPrincipal

Returns

IEnumerable<Claim>

Remarks

auth_time is written as XMLSchema#integer64 whatever the subject's claim says, as Duende's GetAuthenticationTimeEpoch re-creates it — so a sign-in typed string, as IdentityServerUser writes it, reaches the token as a JSON number (0.173.0; copied with its own type until then). Ours copies each when the subject has it, where Duende's requires sub and auth_time; and an auth_time that is not an integer is copied as it is, where Duende's throws and fails the token request.