Class ResourceIndicatorValidation

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.Core.dll

The rules a resource indicator (RFC 8707) is held to wherever a request may carry one.

public static class ResourceIndicatorValidation

Inheritance

object

ResourceIndicatorValidation

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

One place, because there are three callers — the authorization endpoint, the backchannel endpoint and the token endpoint — and a rule about which APIs a grant may be for, kept as three copies, is a rule waiting to be applied in two of them. Whether an indicator names an API the scopes reach is the resource validator's, since 0.155.0 (ValidateRequestedResourcesAsync(ResourceValidationRequest, CancellationToken)). The measured outcome is Duende 8.0.1's: invalid_target for an indicator that is malformed or names no API the request reaches. (0.78.0 to 0.93.0 also refused, as invalid_scope, a scope the named API did not expose, and called it measured. It was a log line read as a rule; Duende has no such refusal.)

Fields

Unreached

The description of an indicator naming no API the requested scopes reach. Duende's.

public const string Unreached = "Invalid resource indicator"

Field Value

string

Methods

CheckForNewGrant(IReadOnlyCollection<string>, ResourceValidationResult, int)

Checks the indicators on a request that is about to create a grant, against the scopes that grant would carry.

public static ResourceIndicatorRefusal? CheckForNewGrant(IReadOnlyCollection<string> requested, ResourceValidationResult resources, int maximumLength)

Parameters

requested IReadOnlyCollection<string>

resources ResourceValidationResult

maximumLength int

Returns

ResourceIndicatorRefusal

Null when they may stand; otherwise the error and its description.

Remarks

Measured from Duende 8.0.1's authorize and backchannel validators, in their order and their words: any too long, then any malformed, then any naming no enabled API the requested scopes reach — invalid_target each. Nothing about which scopes the named APIs expose: Duende's resource validator finds an API scope by name alone, and an indicator decides which APIs a token may be addressed to, not which scopes the grant may hold. Since 0.155.0 the built-in validators ask the resource validator, which judges the scopes and indicators together, and CheckFormat(IReadOnlyCollection<string>, int) — an invalid scope still refused first, as before, where Duende refuses the indicator first; this stays for a host that already holds the validated scopes.

CheckFormat(IReadOnlyCollection<string>, int)

Checks the indicators' length and form, before anything is looked up.

public static ResourceIndicatorRefusal? CheckFormat(IReadOnlyCollection<string> requested, int maximumLength)

Parameters

requested IReadOnlyCollection<string>

maximumLength int

Returns

ResourceIndicatorRefusal

Null when every one may be looked up; otherwise the error and its description.

Remarks

Duende 8.0.1's authorize and backchannel validators' first two checks, in their order and words: any too long, then any malformed — invalid_target each. Since 0.155.0 they ask the resource validator the third, through ValidateRequestedResourcesAsync(ResourceValidationRequest, CancellationToken), after refusing an invalid scope, as before.

IsWellFormed(string, int)

RFC 8707 §2: an absolute URI with no fragment, and no longer than this server reads.

public static bool IsWellFormed(string resource, int maximumLength)

Parameters

resource string

maximumLength int

Returns

bool

Join(IEnumerable<string?>)

The one value several indicators travel as; see Split(string?).

public static string Join(IEnumerable<string?> resources)

Parameters

resources IEnumerable<string>

Returns

string

Split(string?)

The indicators a request carries, from the one space-separated value they travel as.

public static IReadOnlyList<string> Split(string? resources)

Parameters

resources string

Returns

IReadOnlyList<string>

Remarks

RFC 8707 lets a request name several, and every layer between the endpoint and the validator carries a parameter as one string. They travel space-separated, the shape scope already has: an absolute URI cannot contain a space, so the join cannot be mistaken for one indicator.