Class DefaultClientConfigurationValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.Core.dll

Refuses a client registration that cannot work, in Duende's order and with Duende's messages.

public class DefaultClientConfigurationValidator : IClientConfigurationValidator

Inheritance

object

DefaultClientConfigurationValidator

Implements

IClientConfigurationValidator

Derived

ClientConfigurationValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's default, measured: an OpenID Connect client is checked for its grant types, lifetimes, redirect URIs, CORS origins, URI schemes, secrets and properties, each a virtual method, stopping at the first that refuses it; a client of another protocol is not checked. Open, as Duende's is, so a host can add a rule or relax one.

Constructors

DefaultClientConfigurationValidator(IOptions<IdentityServerOptions>)

Creates the validator.

public DefaultClientConfigurationValidator(IOptions<IdentityServerOptions> options)

Parameters

options IOptions<IdentityServerOptions>

This server's options, which the redirect URI scheme check reads.

Exceptions

ArgumentNullException

options is null.

Properties

Options

This server's options, which the redirect URI scheme check reads.

protected IdentityServerOptions Options { get; }

Property Value

IdentityServerOptions

Methods

ValidateAllowedCorsOriginsAsync(ClientConfigurationValidationContext)

Each CORS origin must be an origin: an absolute URI with no path and no trailing slash.

protected virtual Task ValidateAllowedCorsOriginsAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

ValidateAsync(ClientConfigurationValidationContext, CancellationToken)

Checks the context's registration, refusing it through SetError(string).

public virtual Task ValidateAsync(ClientConfigurationValidationContext context, CancellationToken ct)

Parameters

context ClientConfigurationValidationContext

The registration, and where a refusal is recorded.

ct CancellationToken

Cancels the check.

Returns

Task

A task that completes when the check has run.

Exceptions

ArgumentNullException

context is null.

ValidateGrantTypesAsync(ClientConfigurationValidationContext)

A client needs at least one grant type.

protected virtual Task ValidateGrantTypesAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

ValidateLifetimesAsync(ClientConfigurationValidationContext)

Its token lifetimes must be positive, and its refresh lifetimes not negative.

protected virtual Task ValidateLifetimesAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

Remarks

Duende's, measured, quirk and all: a device code lifetime refused does not end the check, so a refresh lifetime refused after it is the message that stands.

ValidatePropertiesAsync(ClientConfigurationValidationContext)

Nothing, as in Duende: a place for a host's own rule about Client.Properties.

protected virtual Task ValidatePropertiesAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

ValidateRedirectUriAsync(ClientConfigurationValidationContext)

A client of an interactive grant needs a redirect URI.

protected virtual Task ValidateRedirectUriAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

Remarks

Duende's, measured, which exempts a confidential client when PushedAuthorization.AllowUnregisteredPushedRedirectUris is on: its pushes may name a redirect URI it never registered. hybrid and implicit are checked by name, as Duende checks them, though this server serves neither.

ValidateSecretsAsync(ClientConfigurationValidationContext)

A client that requires a secret needs one, and client credentials need a secret required.

protected virtual Task ValidateSecretsAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

ValidateUriSchemesAsync(ClientConfigurationValidationContext)

No redirect URI may use a scheme ValidationOptions.InvalidRedirectUriPrefixes refuses.

protected virtual Task ValidateUriSchemesAsync(ClientConfigurationValidationContext context)

Parameters

context ClientConfigurationValidationContext

Returns

Task

Remarks

Duende's messages. Judged by ValidationOptions.IsAllowedRedirectTarget, the check the endpoints make, rather than Duende's bare prefix comparison, so a registration is refused for exactly what a request to it would be. Every URI is checked, and the last refused is the message that stands, as in Duende.