Class RequestObjectValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class RequestObjectValidator : IRequestObjectValidator

Inheritance

object

RequestObjectValidator

Implements

IRequestObjectValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

RequestObjectValidator(IClientStore, IIssuerNameService, IHttpContextAccessor, IJwtRequestUriHttpClient, IReplayCache, IOptions<IdentityServerOptions>, TimeProvider, IJwtRequestValidator?)

Creates the validator, as the container resolves it.

public RequestObjectValidator(IClientStore clients, IIssuerNameService issuerNameService, IHttpContextAccessor httpContextAccessor, IJwtRequestUriHttpClient requestUriClient, IReplayCache replayCache, IOptions<IdentityServerOptions> options, TimeProvider time, IJwtRequestValidator? jwtRequests = null)

Parameters

clients IClientStore

Finds the client a request object is verified against.

issuerNameService IIssuerNameService

Names this server's issuer, for the default JwtRequestValidator.

httpContextAccessor IHttpContextAccessor

Reaches the request in flight, for the default JwtRequestValidator.

requestUriClient IJwtRequestUriHttpClient

Fetches a request object by reference.

replayCache IReplayCache

Remembers each CIBA request object's jti, so it is accepted once.

options IOptions<IdentityServerOptions>

The server options; Endpoints.EnableJwtRequestUri decides whether a reference is fetched.

time TimeProvider

The clock a CIBA request object's jti is remembered against.

jwtRequests IJwtRequestValidator

Verifies the request object; null builds the default JwtRequestValidator.

Methods

ValidateAsync(Dictionary<string, string>, CancellationToken)

Resolves any request object, returning the parameters unchanged when there is none.

public Task<RequestObjectResult> ValidateAsync(Dictionary<string, string> parameters, CancellationToken cancellationToken = default)

Parameters

parameters Dictionary<string, string>

cancellationToken CancellationToken

Returns

Task<RequestObjectResult>

Exceptions

ArgumentNullException

parameters is null.

ValidateBackChannelAuthenticationRequestAsync(string, Client, CancellationToken)

Verifies a signed CIBA authentication request (CIBA Core §7.1.1) from an already authenticated client and returns the parameters it carries, in Values.

public Task<RequestObjectResult> ValidateBackChannelAuthenticationRequestAsync(string requestObject, Client client, CancellationToken cancellationToken = default)

Parameters

requestObject string

client Client

cancellationToken CancellationToken

Returns

Task<RequestObjectResult>

Remarks

The same signature, issuer, audience, lifetime and algorithm checks as a JAR object, plus two a backchannel request needs and a front-channel one does not: a jti, and that the jti has not been seen before. A JAR object travels through a browser once; a CIBA request is a direct call a client could simply repeat, and each repeat makes somebody's phone buzz.

Exceptions

ArgumentException

requestObject is null or empty.

ArgumentNullException

client is null.