#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation')

## IdTokenHintValidator Class

Validates the `id_token_hint` parameter of an authorization request and records the end user it
names, so the endpoint can honour it when it chooses a session\.

```csharp
public class IdTokenHintValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IdTokenHintValidator

Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator')

### Remarks
OpenID Connect Core 1\.0 Section 3\.1\.2\.1: "If the End\-User identified by the ID Token is already logged in
or is logged in as a result of the request \(with the OP possibly evaluating other information beyond the
ID Token in this decision\), then the Authorization Server returns a positive response; otherwise, it MUST
return an error, such as `login_required`\." A parameter parsed and read by nobody leaves a request
naming one end user answerable for another, which costs nothing while a browser holds one session and
stops costing nothing as soon as it holds two\.

The subject is recorded as the ID token spells it, which for a pairwise client is the pseudonym sealed to
that client's sector rather than the subject a session carries. Whoever compares the two converts the
session forward.

Runs after the validators that resolve the redirect URI and the response mode, because its refusals are
the kind RFC 6749 Section 4.1.2.1 says the client must be told about, and before them there is nowhere to
tell it. The [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\.ClientInfo') it reads is resolved earlier still.
### Constructors

## IdTokenHintValidator\(IIdTokenHintParser\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser)}

Validates the `id_token_hint` parameter of an authorization request and records the end user it
names, so the endpoint can honour it when it chooses a session\.

```csharp
public IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser hintParser);
```
#### Parameters

###### `hintParser` [IIdTokenHintParser](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IIdTokenHintParser') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser).hintParser}

Decides whether the hint is an ID token this server issued\.

### Remarks
OpenID Connect Core 1\.0 Section 3\.1\.2\.1: "If the End\-User identified by the ID Token is already logged in
or is logged in as a result of the request \(with the OP possibly evaluating other information beyond the
ID Token in this decision\), then the Authorization Server returns a positive response; otherwise, it MUST
return an error, such as `login_required`\." A parameter parsed and read by nobody leaves a request
naming one end user answerable for another, which costs nothing while a browser holds one session and
stops costing nothing as soon as it holds two\.

The subject is recorded as the ID token spells it, which for a pairwise client is the pseudonym sealed to
that client's sector rather than the subject a session carries. Whoever compares the two converts the
session forward.

Runs after the validators that resolve the redirect URI and the response mode, because its refusals are
the kind RFC 6749 Section 4.1.2.1 says the client must be told about, and before them there is nowhere to
tell it. The [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\.ClientInfo') it reads is resolved earlier still.
### Methods

## IdTokenHintValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)}

Asynchronously validates an authorization request within a given context\.

```csharp
public System.Threading.Tasks.Task<Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError?> ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context);
```
#### Parameters

###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context}

The [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') that contains the details
of the authorization request to be validated\.

Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
A task that represents the asynchronous validation operation\. The task result contains
an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if a validation error is found,
or null if validation is successful\.