Class DefaultSenderConstraintValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DefaultSenderConstraintValidator : ISenderConstraintValidator

Inheritance

object

DefaultSenderConstraintValidator

Implements

ISenderConstraintValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

DefaultSenderConstraintValidator(IDPoPProofValidator, IEventService, IClientStore)

Creates the validator, as the container resolves it.

public DefaultSenderConstraintValidator(IDPoPProofValidator dpop, IEventService events, IClientStore clients)

Parameters

dpop IDPoPProofValidator

Validates the request's DPoP proof against the token.

events IEventService

Receives a SenderConstraintViolationEvent when a bound token arrives without its binding.

clients IClientStore

Finds the client the token was issued to, whose settings decide how its proofs are held.

Methods

ValidateAsync(HttpContext, PresentedAccessToken, CancellationToken)

Whether the request presenting presented proves possession of what its cnf binds it to.

public Task<SenderConstraintResult> ValidateAsync(HttpContext context, PresentedAccessToken presented, CancellationToken cancellationToken = default)

Parameters

context HttpContext

The request the token was presented on: its DPoP proof, or its client certificate.

presented PresentedAccessToken

The token, its claims, and the scheme it came under.

cancellationToken CancellationToken

Cancels the check.

Returns

Task<SenderConstraintResult>

Satisfied, or the refusal and the challenge to answer it with.

Remarks

A token with no cnf is satisfied under Bearer and refused under DPoP. A cnf.jkt needs a valid DPoP proof by that key, for this token, under the DPoP scheme; a cnf.x5t#S256 is refused under DPoP and otherwise needs the connection's client certificate to match. A cnf this server cannot read is refused.

Exceptions

ArgumentNullException

context or presented is null.