Class PrivateKeyJwtSecretValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Verifies a private_key_jwt client assertion against the client's registered JWK secrets.

public sealed class PrivateKeyJwtSecretValidator : ISecretValidator

Inheritance

object

PrivateKeyJwtSecretValidator

Implements

ISecretValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The client signs a short-lived assertion with a private key and the server checks it against the public key on the registration, so no shared password ever crosses the wire or sits in the server's store.

Constructors

PrivateKeyJwtSecretValidator(IHttpContextAccessor, IIssuerNameService, IOptions<IdentityServerOptions>, IReplayCache?)

Creates the validator, as the container resolves it.

public PrivateKeyJwtSecretValidator(IHttpContextAccessor httpContextAccessor, IIssuerNameService issuerNameService, IOptions<IdentityServerOptions> options, IReplayCache? replayCache = null)

Parameters

httpContextAccessor IHttpContextAccessor

Reaches the request in flight, whose URL is one audience an assertion may name.

issuerNameService IIssuerNameService

Names this server's issuer, the other audience an assertion may name.

options IOptions<IdentityServerOptions>

The server options; SupportedClientAssertionSigningAlgorithms are the algorithms accepted.

replayCache IReplayCache

Remembers each assertion's jti so it is accepted once; null takes every assertion on trust.

Methods

ValidateAsync(IEnumerable<Secret>, ParsedSecret, CancellationToken)

Verifies a private_key_jwt assertion (RFC 7523): signed by one of secrets' keys, issued by and about the client, addressed to this server's issuer or the URL it was sent to, current, and — with a replay cache — its jti not seen before.

public Task<SecretValidationResult> ValidateAsync(IEnumerable<Secret> secrets, ParsedSecret parsedSecret, CancellationToken cancellationToken = default)

Parameters

secrets IEnumerable<Secret>

The client's registered secrets, whose JSON Web Keys and certificates verify the assertion.

parsedSecret ParsedSecret

The credential presented; only a JWT bearer assertion is checked.

cancellationToken CancellationToken

Cancels the replay cache lookup.

Returns

Task<SecretValidationResult>

Success, or failure for anything else.

Remarks

With StrictClientAssertionAudienceValidation, or for an assertion typed client-authentication+jwt, the audience must be exactly one, the issuer, and the type that one — Duende 8.0.1's, measured, taken in 0.176.0.

Exceptions

ArgumentNullException

secrets or parsedSecret is null.