Class ScopeClaims

Namespace: Fdyay.IdentityServer.Validation

Assembly: Fdyay.IdentityServer.Core.dll

Reads the scopes off a validated access token's claims, in either shape they can arrive in.

public static class ScopeClaims

Inheritance: object

ScopeClaims

Inherited Members: object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A JWT access token carries scope as one space-delimited string (RFC 9068 §2.2.3), and a reference token's stored claims carry one value each. JsonWebTokenHandler hands back a single claim holding "api reports" for the first and two claims for the second, so a reader comparing Claim.Value gets a different answer for the same token depending on how it was carried.

One place, because there are three readers — the local API scheme, UserInfo and introspection — and the interesting failure is silent in all three: a token that genuinely holds the required scope is refused, or a scope is reported to a resource server under a name nobody registered.

Methods

From(IEnumerable<Claim>)

The scopes named by the scope claims among claims.

public static IReadOnlyList<string> From(IEnumerable<Claim> claims)

Parameters

claims IEnumerable<Claim>

Returns