Class ValidatedTokenRequest
- Namespace
- Fdyay.IdentityServer.Validation
- Assembly
- Fdyay.IdentityServer.Core.dll
A validated token request.
public sealed class ValidatedTokenRequest : IValidatedRequest- Inheritance
-
ValidatedTokenRequest
- Implements
- Inherited Members
Properties
AccessTokenLifetime
How long the access token this request issues lives, in seconds. The client's, unless set.
public int AccessTokenLifetime { get; set; }Property Value
Remarks
Duende's ValidatedRequest.AccessTokenLifetime, which its SetClient copies from the client, and which
its token service, refresh path and expires_in read: a custom validator or an extension grant changes it
for this one request. Read through to the client until set, where Duende copies it — the same answer, and a
request built without the validator still gives the client's.
AccessTokenType
Whether the access token this request issues is a JWT or a reference. The client's, unless set.
public IdentityServerConstants.AccessTokenType AccessTokenType { get; set; }Property Value
Remarks
Duende's, as AccessTokenLifetime is.
AuthorizationCode
The authorization code being redeemed, on a code grant.
public AuthorizationCode? AuthorizationCode { get; set; }Property Value
Remarks
Duende's, set as the code is validated, for a hook that needs more of the code than the request carries.
AuthorizedResourceIndicators
The APIs the grant was authorized for by resource indicator — from the code, or the refresh token — which a token request may name and may not go beyond. Empty when the authorization named none.
public ICollection<string> AuthorizedResourceIndicators { get; }Property Value
Remarks
Carried onto the refresh token issued in the response, so the restriction outlives the code.
BackChannelAuthenticationRequest
The backchannel request being redeemed, on a CIBA grant — set by IBackchannelAuthenticationRequestIdValidator.
public BackChannelAuthenticationRequest? BackChannelAuthenticationRequest { get; set; }Property Value
Remarks
Duende's, for the same reason as DeviceCode.
BoundDPoPKeyThumbprint
The DPoP key the grant being redeemed is already bound to, if any.
public string? BoundDPoPKeyThumbprint { get; set; }Property Value
Remarks
One property for both grants on purpose. A code carrying dpop_jkt and a refresh token issued
under DPoP pose the same question — may this key redeem this grant — and answering it in one place is
what stops the two drifting into different answers.
Client
The authenticated client making the request.
public Client Client { get; set; }Property Value
ClientClaims
The client claims the access token this request issues carries. A copy of the client's, unless set.
[SuppressMessage("Usage", "CA2227:Collection properties should be read only", Justification = "Duende's shape: a hook may replace it.")]
public ICollection<Claim> ClientClaims { get; set; }Property Value
Remarks
Duende's: SetClient copies each of the client's claims, and its claims service issues these rather than the
client's, under the client's prefix and its AlwaysSendClientClaims rule. Copied the first
time it is read, so a hook that adds to it changes this request and not the client.
Confirmation
The confirmation (cnf) to bind into the issued access token, when the client authenticated with a
credential that carries one.
public string? Confirmation { get; set; }Property Value
DPoPKeyThumbprint
The thumbprint of the DPoP key the client proved it holds, or null when it presented no proof.
public string? DPoPKeyThumbprint { get; set; }Property Value
Remarks
The thumbprint rather than a flag beside Confirmation. A flag would be exactly
"thumbprint is not null" and would carry no fact this does not — the shape 0.14.0 deleted
ShowSignoutPrompt for. It decides three things: the cnf the access token carries, the
response's token_type, and what a refresh token issued here is bound to.
Description
The name the user gave the grant being redeemed, read off it, for the tokens it yields.
public string? Description { get; set; }Property Value
Remarks
Duende's validated request carries the code, device code or backchannel request itself, and its token response generator reads the description off whichever it was; the grant is read once here instead, as the session id is.
DeviceCode
The device code being redeemed, on a device code grant — set by IDeviceCodeValidator.
public DeviceCode? DeviceCode { get; set; }Property Value
Remarks
Duende's: the device code validator hands the code it found to the rest of the token request this way.
GrantType
The request's grant_type (RFC 6749 §4), such as authorization_code or refresh_token.
public string GrantType { get; set; }Property Value
IsOpenId
Whether the grant includes the openid scope; with a Subject, the response then carries an identity token.
public bool IsOpenId { get; set; }Property Value
Issuer
The issuer the request was served as, written by the token endpoint once the request is valid.
public string Issuer { get; set; }Property Value
Nonce
The nonce of the authorize request an authorization code was issued for, carried into the identity token.
public string? Nonce { get; set; }Property Value
Options
The options the request was validated under. Duende's ValidatedRequest.Options.
public IdentityServerOptions Options { get; set; }Property Value
PushedAuthenticationRequestId
The CIBA request whose answer this response will be pushed to the client as, or null when the response goes back from the token endpoint.
public string? PushedAuthenticationRequestId { get; set; }Property Value
Remarks
Set by the push delivery and nowhere else. It is what makes the identity token carry
auth_req_id and rt_hash (CIBA Core §10.3.1), which a push needs and a token response does
not — the response itself answers the request that asked for it.
Raw
Every parameter of the request's form.
public IReadOnlyDictionary<string, string> Raw { get; set; }Property Value
Remarks
Duende's ValidatedRequest.Raw, as a map of single strings as this server reads a form. What a custom
validator reads a parameter of its own from, since nothing else on the request carries one.
RefreshToken
The validated refresh token (refresh_token grant only).
public RefreshToken? RefreshToken { get; set; }Property Value
RefreshTokenHandle
The presented refresh token handle (refresh_token grant only).
public string? RefreshTokenHandle { get; set; }Property Value
RequestedResourceIndicator
The resource the access token is to be narrowed to (RFC 8707), or null for none.
public string? RequestedResourceIndicator { get; set; }Property Value
Remarks
Already checked to be one of the APIs ValidatedResources reaches. It narrows the access token and nothing else: the refresh token beside it is the grant, and keeps all of it.
Scopes
The scope values granted to this request, which the issued tokens carry.
public ICollection<string> Scopes { get; }Property Value
Secret
The credential the client authenticated with, or null when the request did not come from a client's call.
public ParsedSecret? Secret { get; set; }Property Value
Remarks
Duende's ValidatedRequest.Secret, which its SetClient sets before the grant is validated: read by
nothing here, there for an extension grant or a custom validator to inspect. Null for a CIBA push, which this
server redeems itself.
SessionId
The user's session the grant was issued in, if it was issued in one.
public string? SessionId { get; set; }Property Value
Remarks
Carried from the authorization code, and from the refresh token after it, to the tokens this request issues:
the access token as its sid, the refresh token as the session it is revoked with.
Subject
The user the tokens are issued for; null for a grant with no user, such as client_credentials.
public ClaimsPrincipal? Subject { get; set; }Property Value
ValidatedResources
The identity resources, API resources and API scopes the granted scopes resolved to.
public ResourceValidationResult ValidatedResources { get; set; }