Table of Contents

Class DefaultTokenValidator

Namespace
Fdyay.IdentityServer.Validation
Assembly
Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DefaultTokenValidator : ITokenValidator
Inheritance
DefaultTokenValidator
Implements
Inherited Members

Constructors

DefaultTokenValidator(IKeyMaterialService, IReferenceTokenStore, IOptions<IdentityServerOptions>, IClientStore?, IEnumerable<ISessionCoordinationService>?, ICustomTokenValidator?, IProfileService?) 

public DefaultTokenValidator(IKeyMaterialService keys, IReferenceTokenStore referenceTokenStore, IOptions<IdentityServerOptions> options, IClientStore? clients = null, IEnumerable<ISessionCoordinationService>? sessions = null, ICustomTokenValidator? customValidator = null, IProfileService? profile = null)

Parameters

keys IKeyMaterialService

The keys a JWT may be signed with.

referenceTokenStore IReferenceTokenStore

Where reference tokens are kept.

options IOptions<IdentityServerOptions>

This server's options.

clients IClientStore

The registered clients, for the client a token's session is asked about.

sessions IEnumerable<ISessionCoordinationService>

Asked whether a token's session is still there, when one is registered — enumerated, so a host without server-side sessions asks nothing.

customValidator ICustomTokenValidator

The host's own checks, asked last; the default lets every token stand.

profile IProfileService

Asked whether the token's user is still active, when one is registered.

Methods

ValidateAccessTokenAsync(string, string, CancellationToken)

Validates an access token presented to this server, whether a JWT or a reference handle.

public Task<AccessTokenValidationResult> ValidateAccessTokenAsync(string token, string issuer, CancellationToken cancellationToken = default)

Parameters

token string

The token as presented: a compact JWT or a reference token handle.

issuer string

This server's issuer, which a JWT's iss must match.

cancellationToken CancellationToken

Cancels the key, store, session and profile lookups.

Returns

Task<AccessTokenValidationResult>

The token's claims and audiences, or the error it was refused with.

Remarks

A token over the input length limit is refused before a key is fetched or a store asked. A token that validates is then refused if its session is gone or its user no longer active, and the host's custom token validator is asked last.

The error, as Duende 8.0.1's TokenValidator answers, measured: expired_token for a JWT past its lifetime; invalid_token for any other JWT that fails validation (signature, issuer, one that does not parse) and for a reference handle the store does not have — an expired reference token among them, which the store does not return; invalid_request only when no token was given. Until 0.174.0 every failure of a JWT and every unknown handle was invalid_request.

A JWT must be an access token: typed AccessTokenJwtType when that is set, as Duende's, and — where that type cannot tell it from an identity or logout token — naming its client and carrying no nonce, azp or events. Anything else is invalid_token. Since 0.176.0; until then an identity token or a logout token this server had signed validated here.

ValidateIdentityTokenHintAsync(string, string, string, CancellationToken)

Validates an identity token this server issued to clientId, presented back as a hint.

public Task<IdentityTokenValidationResult> ValidateIdentityTokenHintAsync(string token, string issuer, string clientId, CancellationToken cancellationToken = default)

Parameters

token string
issuer string
clientId string
cancellationToken CancellationToken

Returns

Task<IdentityTokenValidationResult>

Remarks

Lifetime is deliberately not checked: a hint names a user, and an expired identity token still names the subject this server issued it for. Everything that says whose token it is, is checked.