Interface IBackchannelAuthenticationUserValidator
- Namespace
- Fdyay.IdentityServer.Validation
- Assembly
- Fdyay.IdentityServer.Core.dll
Resolves a client's hints about a user to a subject this server can authenticate.
public interface IBackchannelAuthenticationUserValidatorRemarks
The first of the two things a host must supply before CIBA can work, and the reason the endpoint is off until
it does. There is no general way to turn login_hint into a subject: what a hint means is an agreement
between a deployment and its clients, and a default implementation that matched strings against a user store
would be a guess this library is in no position to make.
It is also the security boundary of the whole flow. A CIBA request is a client asserting who it wants authenticated, with no browser, no redirect URI and no user present to contradict it — so this is the one place that decides whether that assertion is honoured, and the place a host puts any rule about which of its clients may ask about which of its users.
Methods
ValidateAsync(BackChannelAuthenticationUserValidationContext, CancellationToken)
Resolves the hints, or explains why they resolve to nobody.
Task<BackchannelAuthenticationUserValidationResult> ValidateAsync(BackChannelAuthenticationUserValidationContext context, CancellationToken cancellationToken = default)Parameters
contextBackChannelAuthenticationUserValidationContextcancellationTokenCancellationToken