Class DefaultTokenCreationService

Namespace

Fdyay.IdentityServer.Services.Tokens

Assembly

Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public class DefaultTokenCreationService : ITokenCreationService

Inheritance

object

DefaultTokenCreationService

Implements

ITokenCreationService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's DefaultTokenCreationService, measured: a token is made in three protected virtual steps, in Duende's order — CreatePayloadAsync(Token), CreateHeaderElementsAsync(Token), then CreateJwtAsync(Token, string, Dictionary<string, object>, CancellationToken), which signs. A host that signs with an HSM or a cloud key service overrides the last and keeps the rest.

Where ours differs: CreateTokenAsync(Token, CancellationToken), which runs the steps, is not virtual, and reads back the JWT the last step made before it leaves — signed with one of the nine asymmetric algorithms this server signs with, with one the token allows when it names any (AllowedSigningAlgorithms), and a logout token typed as LogoutTokenJwtType says (logout+jwt by default). An override of a step cannot issue a token this server would refuse to.

Constructors

DefaultTokenCreationService(IKeyMaterialService, TimeProvider, IOptions<IdentityServerOptions>)

A token creation service signing with keys.

public DefaultTokenCreationService(IKeyMaterialService keys, TimeProvider time, IOptions<IdentityServerOptions> options)

Parameters

keys IKeyMaterialService

The keys tokens are signed with; available to a derived class as Keys.

time TimeProvider

The clock a token's times are read from; available as TimeProvider.

options IOptions<IdentityServerOptions>

The server's options; available as Options.

Properties

Keys

The keys tokens are signed with. Duende's.

protected IKeyMaterialService Keys { get; }

Property Value

IKeyMaterialService

Options

The server's options. Duende's.

protected IdentityServerOptions Options { get; }

Property Value

IdentityServerOptions

TimeProvider

The clock. Duende's.

protected TimeProvider TimeProvider { get; }

Property Value

TimeProvider

Methods

CreateHeaderElementsAsync(Token)

The JWT's header elements beyond those the signing key brings (alg, kid): its typ. Duende's step.

protected virtual Task<Dictionary<string, object>> CreateHeaderElementsAsync(Token token)

Parameters

token Token

Returns

Task<Dictionary<string, object>>

CreateJwtAsync(Token, string, Dictionary<string, object>, CancellationToken)

Signs payload under headerElements, with the key for an algorithm the token allows. Duende's step, and the one a host signing with an HSM or a cloud key service overrides.

protected virtual Task<string> CreateJwtAsync(Token token, string payload, Dictionary<string, object> headerElements, CancellationToken cancellationToken)

Parameters

token Token

payload string

headerElements Dictionary<string, object>

cancellationToken CancellationToken

Returns

Task<string>

Exceptions

InvalidOperationException

No key is available for an algorithm the token allows.

CreatePayloadAsync(Token)

The JWT's payload, as JSON. Duende's step.

protected virtual Task<string> CreatePayloadAsync(Token token)

Parameters

token Token

Returns

Task<string>

CreateTokenAsync(Token, CancellationToken)

Serializes and signs a token as a JWT.

public Task<string> CreateTokenAsync(Token token, CancellationToken cancellationToken = default)

Parameters

token Token

The token to sign.

cancellationToken CancellationToken

Cancels the signing.

Returns

Task<string>

The signed JWT, in compact serialization.

Exceptions

InvalidOperationException

What the steps made is not a JWT, is signed with an algorithm this server does not sign with or the token does not allow, or is a logout token not typed as LogoutTokenJwtType says.