Class X509ThumbprintSecretValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.Core.dll

Checks a client certificate against the SHA-256 thumbprints registered for the client (RFC 8705).

public sealed class X509ThumbprintSecretValidator : ISecretValidator

Inheritance

object

X509ThumbprintSecretValidator

Implements

ISecretValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This is the self-signed variant: the registration names the exact certificate, so trust comes from the registration rather than from a certificate authority. Matching a subject name against a CA-issued certificate is a different rule, and lives in X509NameSecretValidator.

Methods

ValidateAsync(IEnumerable<Secret>, ParsedSecret, CancellationToken)

Checks the presented credential against the stored secrets.

public Task<SecretValidationResult> ValidateAsync(IEnumerable<Secret> secrets, ParsedSecret parsedSecret, CancellationToken cancellationToken = default)

Parameters

secrets IEnumerable<Secret>

The stored secrets of the client or API — only unexpired ones, when called by SecretValidator.

parsedSecret ParsedSecret

The credential a secret parser read off the request.

cancellationToken CancellationToken

Cancels the check.

Returns

Task<SecretValidationResult>

Success when the credential matched one of secrets; failure otherwise, and for a credential type this validator does not handle.

Remarks

Only a parsed X.509 certificate is considered, and only against secrets of type X509Thumbprint: the certificate's SHA-256 thumbprint, in hex, must equal one, ignoring case. A match carries the certificate's confirmation, to bind issued tokens to it.

Exceptions

ArgumentNullException

secrets or parsedSecret is null.