Class ResourceValidationResult

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.Core.dll

The outcome of validating requested scopes against a client and the resource store.

public sealed class ResourceValidationResult

Inheritance

object

ResourceValidationResult

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

ResourceValidationResult()

An empty result: nothing granted and nothing invalid, to be filled in by a validator.

public ResourceValidationResult()

ResourceValidationResult(Resources)

A result granting resources, each of its scopes parsed as its own name. Duende's.

public ResourceValidationResult(Resources resources)

Parameters

resources Resources

ResourceValidationResult(Resources, IEnumerable<ParsedScopeValue>)

A result granting resources for the scope values parsedScopeValues. Duende's.

public ResourceValidationResult(Resources resources, IEnumerable<ParsedScopeValue> parsedScopeValues)

Parameters

resources Resources

parsedScopeValues IEnumerable<ParsedScopeValue>

Properties

InvalidResourceIndicators

Resource indicators that name no enabled API the requested scopes reach. Duende's.

public ICollection<string> InvalidResourceIndicators { get; }

Property Value

ICollection<string>

Remarks

Filled only by ValidateRequestedResourcesAsync(ResourceValidationRequest, CancellationToken), which is asked with them.

InvalidScopes

Scopes that were requested but are not allowed or do not exist.

public ICollection<string> InvalidScopes { get; }

Property Value

ICollection<string>

ParsedScopes

The scope values that were granted, as the request named them and as the scope parser read them.

public ICollection<ParsedScopeValue> ParsedScopes { get; }

Property Value

ICollection<ParsedScopeValue>

Remarks

Duende's. Each names the scope it asks for — what Resources holds — and the value the request sent, which differs from it for a parameterized scope.

RawScopeValues

The granted scope values, as the request named them. Duende's name; this was GrantedScopes.

public IEnumerable<string> RawScopeValues { get; }

Property Value

IEnumerable<string>

Remarks

Duende's: the raw value of each of ParsedScopes — so a parameterized scope is granted, consented to and carried in a token as the client sent it, not as the scope it names.

Resources

The resources that were granted.

public Resources Resources { get; set; }

Property Value

Resources

Succeeded

Whether all requested scopes, and all resource indicators, were valid.

public bool Succeeded { get; }

Property Value

bool

Remarks

Duende's, but for one thing: Duende's also requires at least one granted scope, and this server has always counted a request for none as valid. Since 0.160.0 the token request asks for one too, for client_credentials and extension grants, with TokenRequestDefaultScopesFromResourceStore.

Methods

FilterByResourceIndicator(string?)

What an access token may carry from this result, for the resource indicator it was asked for.

public ResourceValidationResult FilterByResourceIndicator(string? resourceIndicator)

Parameters

resourceIndicator string

Returns

ResourceValidationResult

Remarks

Without an indicator: everything, less the APIs that require one (RequireResourceIndicator) — they stay out of the audience, though a scope they share with another API is still granted. With one: that API alone, and of the API scopes only those it exposes, so the token is no use to any other API and no wider at the one it names. Identity resources and offline access are untouched either way: they are not about which API may read the token.