Class TokenExchangeGrantValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

RFC 8693 token exchange — impersonation.

public sealed class TokenExchangeGrantValidator : IExtensionGrantValidator

Inheritance

object

TokenExchangeGrantValidator

Implements

IExtensionGrantValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A back-end service holding an access token for a user exchanges it for one of its own, for a different audience. The audience changes; the user does not. Without it the only route is to forward the token it was given, which hands a downstream API a token minted for somebody else, carrying somebody else's scopes.

Shipped as an extension grant rather than a switch arm, and registered by default so a host gets it without wiring. It needs the issuer and this server's own token validator to check that the subject token is one this server issued, and both live in this assembly — the seam 0.28.0 built is what makes that possible without threading an issuer through the core validator's signature. What it decides is *who* the token is for; what the token may reach still goes through the exchanging client's registration and the resource store, exactly as it does for every other grant. A client cannot exchange its way into a scope it could not have asked for directly.

Delegation, as of 0.34.0, and only where a host has said who may act for whom. actor_token turns "act as this user" into "this service, acting for this user": the act claim names the actor, and IDelegationPolicy decides whether it was allowed to. With no policy registered the parameter is refused exactly as it was before — never accepted and ignored, because a plain impersonation token issued for a delegation request is weaker than what the caller asked for under a name saying otherwise.

Only an access token the token endpoint issued is exchanged, as of 0.176.0 — as the subject token and as the actor token: one the access token validator accepts (so not an identity token or a logout token) that names its client and its scopes. Until then an identity token a relying party had been given was exchanged for an access token as its user.

Constructors

TokenExchangeGrantValidator(ITokenValidator, IIssuerNameService, IEnumerable<IDelegationPolicy>)

public TokenExchangeGrantValidator(ITokenValidator tokenValidator, IIssuerNameService issuerNameService, IEnumerable<IDelegationPolicy> delegationPolicies)

Parameters

tokenValidator ITokenValidator

issuerNameService IIssuerNameService

delegationPolicies IEnumerable<IDelegationPolicy>

Remarks

The policy arrives as a collection so that "none registered" is a resolvable state rather than a container failure — the same shape IEnumerable<IExtensionGrantValidator> has. More than one is a host mistake this cannot silently pick a winner for, so the first is taken and the rest would be ignored; a host wanting several rules composes them behind one policy, where it can see the order.

Properties

GrantType

The token exchange grant type, urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693 §2.1).

public string GrantType { get; }

Property Value

string

Methods

ValidateAsync(ExtensionGrantValidationContext, CancellationToken)

Resolves the grant, or explains why it does not resolve.

public Task<ExtensionGrantValidationResult> ValidateAsync(ExtensionGrantValidationContext context, CancellationToken cancellationToken = default)

Parameters

context ExtensionGrantValidationContext

cancellationToken CancellationToken

Returns

Task<ExtensionGrantValidationResult>

Exceptions

ArgumentNullException

context is null.