Class X509NameSecretValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.Core.dll

Checks a client certificate's subject distinguished name against the names registered for the client (RFC 8705 tls_client_auth).

public sealed class X509NameSecretValidator : ISecretValidator

Inheritance

object

X509NameSecretValidator

Implements

ISecretValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This is the PKI variant, and it authenticates nothing on its own: a name is not a secret, and anyone can issue themselves a certificate claiming any subject. It is safe only because the transport has already rejected certificates that do not chain to a certificate authority the host trusts — configure that trust (client certificate validation on the listener) before registering a secret of this type, or the registration reduces to "whoever says they are this client is this client".

X509ThumbprintSecretValidator carries no such requirement, because it names one exact certificate rather than a name any certificate may bear.

Methods

ValidateAsync(IEnumerable<Secret>, ParsedSecret, CancellationToken)

Checks the presented credential against the stored secrets.

public Task<SecretValidationResult> ValidateAsync(IEnumerable<Secret> secrets, ParsedSecret parsedSecret, CancellationToken cancellationToken = default)

Parameters

secrets IEnumerable<Secret>

The stored secrets of the client or API — only unexpired ones, when called by SecretValidator.

parsedSecret ParsedSecret

The credential a secret parser read off the request.

cancellationToken CancellationToken

Cancels the check.

Returns

Task<SecretValidationResult>

Success when the credential matched one of secrets; failure otherwise, and for a credential type this validator does not handle.

Remarks

Only a parsed X.509 certificate is considered, and only against secrets of type X509Name: the certificate's whole subject distinguished name must equal one, ignoring case. A match carries the certificate's confirmation, to bind issued tokens to it.

Exceptions

ArgumentNullException

secrets or parsedSecret is null.