RequestedSubjectValidator Class

Refuses a claims request whose sub qualifier is not a string.

public class RequestedSubjectValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator

Inheritance System.Object → RequestedSubjectValidator

Implements IBackChannelAuthenticationContextValidator

Remarks

This endpoint accepts the same claims parameter as the authorization endpoint and honours a sub named in it the same way - OpenID Connect Core 1.0 Section 3.1.2.2 makes that and id_token_hint two ways of stating one requirement. What differs is only where the comparison happens, since the end user answers on a device long afterwards.

A malformed qualifier is refused here rather than left to the comparison, which would treat it as naming nobody and answer as though the end user were simply unreachable. Section 5.5.1 requires the qualifier to be "a valid value for the Claim being requested" and Section 2 makes sub a string, so a number or an object is a request nobody could satisfy, and saying that outright is the difference between a client fixing its request and a client retrying it.

Methods

RequestedSubjectValidator.ValidateAsync(BackChannelAuthenticationValidationContext) Method

Asynchronously validates the backchannel authentication request context. This method checks the context of the request, including client information and requested parameters, to ensure compliance with security and protocol requirements.

public System.Threading.Tasks.Task<Abblix.Oidc.Server.Common.OidcError?> ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context);

Parameters

context BackChannelAuthenticationValidationContext

The context of the backchannel authentication request that needs to be validated.

Implements ValidateAsync(BackChannelAuthenticationValidationContext)

Returns

System.Threading.Tasks.Task<OidcError>
A task that represents the asynchronous validation operation. The task result contains a OidcError if validation fails, or null if the context is valid.