Table of Contents

Class BackchannelAuthenticationRequestValidator

Namespace
Fdyay.IdentityServer.Validation
Assembly
Fdyay.IdentityServer.AspNetCore.dll

Duende's default backchannel authentication request validator.

public class BackchannelAuthenticationRequestValidator : IBackchannelAuthenticationRequestValidator
Inheritance
BackchannelAuthenticationRequestValidator
Implements
Inherited Members

Remarks

In the ASP.NET Core assembly rather than with its interface, because it reads this server's issuer — an id_token_hint is checked against it — and the connection's client certificate, which decides whether a pushed token could honour the client's sender constraint.

The checks are the endpoint's until 0.121.0, moved here in the endpoint's order, with Duende's four that it did not make: a scope is required and bounded, openid missing is invalid_request rather than invalid_scope, login_hint and login_hint_token are bounded, and a user validator error CIBA does not define is unknown_user_id.

Constructors

BackchannelAuthenticationRequestValidator(IBackchannelAuthenticationUserValidator, ICustomBackchannelAuthenticationValidator, IResourceValidator, ITokenValidator, IRequestObjectValidator, IIssuerNameService, IHttpContextAccessor, IOptions<IdentityServerOptions>, ILogger<BackchannelAuthenticationRequestValidator>)

Creates the validator, as the container resolves it.

public BackchannelAuthenticationRequestValidator(IBackchannelAuthenticationUserValidator users, ICustomBackchannelAuthenticationValidator customValidator, IResourceValidator resourceValidator, ITokenValidator tokens, IRequestObjectValidator requestObjects, IIssuerNameService issuers, IHttpContextAccessor httpContextAccessor, IOptions<IdentityServerOptions> options, ILogger<BackchannelAuthenticationRequestValidator> logger)

Parameters

users IBackchannelAuthenticationUserValidator

Resolves the request's hint to the user it names.

customValidator ICustomBackchannelAuthenticationValidator

The host's own checks, asked last.

resourceValidator IResourceValidator

Checks the requested scopes and resource indicators against the client.

tokens ITokenValidator

Validates an id_token_hint as one this server issued.

requestObjects IRequestObjectValidator

Verifies a signed request object and reads its parameters.

issuers IIssuerNameService

Names this server as the issuer an id_token_hint must come from.

httpContextAccessor IHttpContextAccessor

Reaches the request in flight: its issuer and its connection's client certificate.

options IOptions<IdentityServerOptions>

The server options: the input length limits, and the Ciba and MutualTls settings.

logger ILogger<BackchannelAuthenticationRequestValidator>

Receives why a request was refused.

Methods

ValidateRequestAsync(IReadOnlyDictionary<string, string>, ClientSecretValidationResult, CancellationToken)

Validates a backchannel authentication request in the order IBackchannelAuthenticationRequestValidator describes; a refusal is a result carrying the error, not an exception.

public virtual Task<BackchannelAuthenticationRequestValidationResult> ValidateRequestAsync(IReadOnlyDictionary<string, string> parameters, ClientSecretValidationResult clientValidationResult, CancellationToken ct)

Parameters

parameters IReadOnlyDictionary<string, string>

The request's form parameters.

clientValidationResult ClientSecretValidationResult

The client's authentication, already succeeded.

ct CancellationToken

Cancels the validation.

Returns

Task<BackchannelAuthenticationRequestValidationResult>

The validated request, or the error the client is answered with.

Exceptions

ArgumentNullException

parameters or clientValidationResult is null.