IdTokenHintValidator Class

Validates the id_token_hint parameter of an authorization request and records the end user it names, so the endpoint can honour it when it chooses a session.

public class IdTokenHintValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator

Inheritance System.Object → IdTokenHintValidator

Implements IAuthorizationContextValidator

Remarks

OpenID Connect Core 1.0 Section 3.1.2.1: "If the End-User identified by the ID Token is already logged in or is logged in as a result of the request (with the OP possibly evaluating other information beyond the ID Token in this decision), then the Authorization Server returns a positive response; otherwise, it MUST return an error, such as login_required." A parameter parsed and read by nobody leaves a request naming one end user answerable for another, which costs nothing while a browser holds one session and stops costing nothing as soon as it holds two.

The subject is recorded as the ID token spells it, which for a pairwise client is the pseudonym sealed to that client's sector rather than the subject a session carries. Whoever compares the two converts the session forward.

Runs after the validators that resolve the redirect URI and the response mode, because its refusals are the kind RFC 6749 Section 4.1.2.1 says the client must be told about, and before them there is nowhere to tell it. The ClientInfo it reads is resolved earlier still.

Constructors

IdTokenHintValidator(IIdTokenHintParser) Constructor

Validates the id_token_hint parameter of an authorization request and records the end user it names, so the endpoint can honour it when it chooses a session.

public IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser hintParser);

Parameters

hintParser IIdTokenHintParser

Decides whether the hint is an ID token this server issued.

Remarks

OpenID Connect Core 1.0 Section 3.1.2.1: "If the End-User identified by the ID Token is already logged in or is logged in as a result of the request (with the OP possibly evaluating other information beyond the ID Token in this decision), then the Authorization Server returns a positive response; otherwise, it MUST return an error, such as login_required." A parameter parsed and read by nobody leaves a request naming one end user answerable for another, which costs nothing while a browser holds one session and stops costing nothing as soon as it holds two.

The subject is recorded as the ID token spells it, which for a pairwise client is the pseudonym sealed to that client's sector rather than the subject a session carries. Whoever compares the two converts the session forward.

Runs after the validators that resolve the redirect URI and the response mode, because its refusals are the kind RFC 6749 Section 4.1.2.1 says the client must be told about, and before them there is nowhere to tell it. The ClientInfo it reads is resolved earlier still.

Methods

IdTokenHintValidator.ValidateAsync(AuthorizationValidationContext) Method

Asynchronously validates an authorization request within a given context.

public System.Threading.Tasks.Task<Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError?> ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context);

Parameters

context AuthorizationValidationContext

The AuthorizationValidationContext that contains the details of the authorization request to be validated.

Implements ValidateAsync(AuthorizationValidationContext)

Returns

System.Threading.Tasks.Task<AuthorizationRequestValidationError>
A task that represents the asynchronous validation operation. The task result contains an AuthorizationRequestValidationError if a validation error is found, or null if validation is successful.