Class JwtRequestValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Duende's default request object validator.

public class JwtRequestValidator : IJwtRequestValidator

Inheritance

object

JwtRequestValidator

Implements

IJwtRequestValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

In the ASP.NET Core assembly rather than with its interface, because the audience is this server's issuer, read off the request in flight. Open, with Duende's protected virtual steps. Two choices of this server's are kept: a fixed five-minute clock skew rather than JwtValidationClockSkew, and a key whose secret has expired no longer vouching for an object.

Constructors

JwtRequestValidator(IOptions<IdentityServerOptions>, IIssuerNameService, IHttpContextAccessor, TimeProvider)

Creates the validator, as the container resolves it.

public JwtRequestValidator(IOptions<IdentityServerOptions> options, IIssuerNameService issuerNameService, IHttpContextAccessor httpContextAccessor, TimeProvider timeProvider)

Parameters

options IOptions<IdentityServerOptions>

The server options: the accepted signing algorithms, strict JAR validation and the JWT length limit.

issuerNameService IIssuerNameService

Names this server's issuer, the audience a request object must name.

httpContextAccessor IHttpContextAccessor

Reaches the request in flight, for the issuer.

timeProvider TimeProvider

The clock a client secret's expiry is read against.

Exceptions

ArgumentNullException

options is null.

Fields

JarType

The media type RFC 9101 §10.8 registers for a request object.

public const string JarType = "oauth-authz-req+jwt"

Field Value

string

Properties

HttpContextAccessor

Reaches the request in flight, for the issuer.

protected IHttpContextAccessor HttpContextAccessor { get; }

Property Value

IHttpContextAccessor

IssuerNameService

Names this server's issuer, the audience a request object must name.

protected IIssuerNameService IssuerNameService { get; }

Property Value

IIssuerNameService

Options

The server options, as they stood when the validator was created.

protected IdentityServerOptions Options { get; }

Property Value

IdentityServerOptions

TimeProvider

The clock a client secret's expiry is read against.

protected TimeProvider TimeProvider { get; }

Property Value

TimeProvider

Methods

GetAudienceUri(CancellationToken)

The audience a request object must name: this server's issuer for the request in flight.

protected virtual Task<string?> GetAudienceUri(CancellationToken ct)

Parameters

ct CancellationToken

Returns

Task<string>

Remarks

Null off a request: there is nothing to derive the issuer from, and guessing would check the object against an audience nobody addressed.

GetKeysAsync(Client)

The client's keys a request object may be signed with: its certificate and JSON Web Key secrets that have not expired, read as GetKeysAsync(IEnumerable<Secret>) reads them for a client assertion.

protected virtual Task<IReadOnlyList<SecurityKey>> GetKeysAsync(Client client)

Parameters

client Client

Returns

Task<IReadOnlyList<SecurityKey>>

Remarks

Expired secrets are dropped here. SecretValidator drops them centrally for the credentials it checks, but this path does not go through it — so without this an expired key would go on vouching for the parameters of authorization requests after it had stopped being able to authenticate the client.

ProcessPayloadAsync(JwtRequestValidationContext, JsonWebToken)

The object's claims, less those that belong to the JWT rather than the request; jti kept when asked for.

protected virtual Task<IReadOnlyList<Claim>> ProcessPayloadAsync(JwtRequestValidationContext context, JsonWebToken token)

Parameters

context JwtRequestValidationContext

token JsonWebToken

Returns

Task<IReadOnlyList<Claim>>

ValidateAsync(JwtRequestValidationContext, CancellationToken)

Validates a request object as IJwtRequestValidator describes, against the client's unexpired keys; a failure is a result with IsError set, and says no more.

public virtual Task<JwtRequestValidationResult> ValidateAsync(JwtRequestValidationContext context, CancellationToken ct)

Parameters

context JwtRequestValidationContext

The client, the object, and how strictly it is held.

ct CancellationToken

Cancels the validation.

Returns

Task<JwtRequestValidationResult>

The object's payload, or the failure.

Exceptions

ArgumentNullException

context, its Client or its JwtTokenString is null.

ValidateJwtAsync(JwtRequestValidationContext, IReadOnlyList<SecurityKey>, CancellationToken)

Validates the object's signature, issuer, audience, lifetime, algorithm and, under strict JAR validation, type.

protected virtual Task<JsonWebToken?> ValidateJwtAsync(JwtRequestValidationContext context, IReadOnlyList<SecurityKey> keys, CancellationToken ct)

Parameters

context JwtRequestValidationContext

keys IReadOnlyList<SecurityKey>

ct CancellationToken

Returns

Task<JsonWebToken>

The verified object, or null when anything about it does not hold.