Interface IDelegationPolicy
- Namespace
- Fdyay.IdentityServer.Validation
- Assembly
- Fdyay.IdentityServer.Core.dll
Decides whether an actor may act for a subject (RFC 8693 delegation).
public interface IDelegationPolicyRemarks
No default implementation, deliberately. Who may act for whom is a fact about an organisation, not
about OAuth: it is the same class of question as what a login_hint means, which is why CIBA's user
validator got this treatment in 0.27.0. A library answering it by guessing would either refuse delegations
that are fine or — far worse — permit ones that are not, and the second failure is invisible until it
matters.
RFC 8693 §4.4 describes the token-borne form of this as may_act: a claim in the subject token naming
who may act for it. That is one way to implement this interface, not a replacement for it — the RFC leaves
the determination to the authorization server, and a host is free to keep the answer in a database, a
configuration file, or the subject token's own may_act claim, which reaches a policy through
DelegationContext.
While no policy is registered, a token exchange carrying actor_token is refused. That is the
shipped default and it is the safe direction: a server that quietly issued a plain impersonation token
instead would hand the caller something weaker than it asked for, under a name saying otherwise.
Methods
MayActAsync(DelegationContext, CancellationToken)
Whether this actor may act for this subject.
Task<bool> MayActAsync(DelegationContext context, CancellationToken cancellationToken = default)Parameters
contextDelegationContextcancellationTokenCancellationToken