Skip to content

Commit 61df9b5

Browse files
josephdecockjosephdecock
authored
Merge pull request #4 from DuendeSoftware/joe/private-key-jwt-client
Added two new clients authenticated with client assertions
2 parents 56136a5 + ab268b6 commit 61df9b5

File tree

2 files changed

+84
-1
lines changed

2 files changed

+84
-1
lines changed

‎src/Config.cs

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,33 @@ public class Config
184184
RefreshTokenUsage = TokenUsage.ReUse,
185185
RefreshTokenExpiration = TokenExpiration.Sliding
186186
},
187+
188+
new Client
189+
{
190+
ClientId = "interactive.confidential.jwt",
191+
ClientName = "Interactive client (Code with PKCE) using private key JWT authentication",
192+
193+
RedirectUris = { "https://notused" },
194+
PostLogoutRedirectUris = { "https://notused" },
195+
196+
ClientSecrets =
197+
{
198+
new Secret
199+
{
200+
Type = IdentityServerConstants.SecretTypes.JsonWebKey,
201+
Value = "{'e':'AQAB','kid':'ZzAjSnraU3bkWGnnAqLapYGpTyNfLbjbzgAPbbW2GEA','kty':'RSA','n':'wWwQFtSzeRjjerpEM5Rmqz_DsNaZ9S1Bw6UbZkDLowuuTCjBWUax0vBMMxdy6XjEEK4Oq9lKMvx9JzjmeJf1knoqSNrox3Ka0rnxXpNAz6sATvme8p9mTXyp0cX4lF4U2J54xa2_S9NF5QWvpXvBeC4GAJx7QaSw4zrUkrc6XyaAiFnLhQEwKJCwUw4NOqIuYvYp_IXhw-5Ti_icDlZS-282PcccnBeOcX7vc21pozibIdmZJKqXNsL1Ibx5Nkx1F1jLnekJAmdaACDjYRLL_6n3W4wUp19UvzB1lGtXcJKLLkqB6YDiZNu16OSiSprfmrRXvYmvD8m6Fnl5aetgKw'}"
202+
}
203+
},
204+
205+
AllowedGrantTypes = GrantTypes.CodeAndClientCredentials,
206+
RequireRequestObject = true,
207+
AllowedScopes = AllScopes,
208+
209+
AllowOfflineAccess = true,
210+
RefreshTokenUsage = TokenUsage.ReUse,
211+
RefreshTokenExpiration = TokenExpiration.Sliding
212+
},
213+
187214
new Client
188215
{
189216
ClientId = "interactive.confidential.jar.jwt",
@@ -231,6 +258,35 @@ public class Config
231258

232259
AccessTokenLifetime = 75
233260
},
261+
262+
new Client
263+
{
264+
ClientId = "interactive.confidential.short.jwt",
265+
ClientName = "Interactive client (Code with PKCE) using private key JWT authentication with short access token lifetime",
266+
267+
RedirectUris = { "https://notused" },
268+
PostLogoutRedirectUris = { "https://notused" },
269+
270+
ClientSecrets =
271+
{
272+
new Secret
273+
{
274+
Type = IdentityServerConstants.SecretTypes.JsonWebKey,
275+
Value = "{'e':'AQAB','kid':'ZzAjSnraU3bkWGnnAqLapYGpTyNfLbjbzgAPbbW2GEA','kty':'RSA','n':'wWwQFtSzeRjjerpEM5Rmqz_DsNaZ9S1Bw6UbZkDLowuuTCjBWUax0vBMMxdy6XjEEK4Oq9lKMvx9JzjmeJf1knoqSNrox3Ka0rnxXpNAz6sATvme8p9mTXyp0cX4lF4U2J54xa2_S9NF5QWvpXvBeC4GAJx7QaSw4zrUkrc6XyaAiFnLhQEwKJCwUw4NOqIuYvYp_IXhw-5Ti_icDlZS-282PcccnBeOcX7vc21pozibIdmZJKqXNsL1Ibx5Nkx1F1jLnekJAmdaACDjYRLL_6n3W4wUp19UvzB1lGtXcJKLLkqB6YDiZNu16OSiSprfmrRXvYmvD8m6Fnl5aetgKw'}"
276+
}
277+
},
278+
279+
AllowedGrantTypes = GrantTypes.CodeAndClientCredentials,
280+
RequireRequestObject = true,
281+
AllowedScopes = AllScopes,
282+
283+
AllowOfflineAccess = true,
284+
RefreshTokenUsage = TokenUsage.ReUse,
285+
RefreshTokenExpiration = TokenExpiration.Sliding,
286+
287+
AccessTokenLifetime = 75
288+
},
289+
234290
new Client
235291
{
236292
ClientId = "interactive.confidential.short.jar.jwt",

‎src/Pages/Index.cshtml

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,13 @@
8888
access token lifetime: 60 minutues<br/>
8989
allowed scopes: openid profile email api offline_access
9090
</li>
91+
<li>
92+
<b>client id: interactive.confidential.jwt</b> <br/>
93+
grant type: authorization code with PKCE and private key jwt client credentials<br/>
94+
client secret: private key JWT <br/>
95+
access token lifetime: 60 minutues<br/>
96+
allowed scopes: openid profile email api offline_access
97+
</li>
9198
<li>
9299
<b>client id: interactive.confidential.jar.jwt</b> <br/>
93100
grant type: authorization code with PKCE and client credentials - requires JAR<br/>
@@ -102,6 +109,13 @@
102109
access token lifetime: 75 seconds <br/>
103110
allowed scopes: openid profile email api offline_access
104111
</li>
112+
<li>
113+
<b>client id: interactive.confidential.short.jwt</b> <br/>
114+
grant type: authorization code with PKCE and private key jwt client credentials<br/>
115+
client secret: private key JWT <br/>
116+
access token lifetime: 75 seconds<br/>
117+
allowed scopes: openid profile email api offline_access
118+
</li>
105119
<li>
106120
<b>client id: interactive.confidential.short.jar.jwt</b> <br/>
107121
grant type: authorization code with PKCE and client credentials - requires JAR<br/>
@@ -141,7 +155,20 @@
141155
<li>
142156
You can use the below RSA key for all clients requiring private key JWT authentication or JAR:
143157
<pre>
144-
{'d':'GmiaucNIzdvsEzGjZjd43SDToy1pz-Ph-shsOUXXh-dsYNGftITGerp8bO1iryXh_zUEo8oDK3r1y4klTonQ6bLsWw4ogjLPmL3yiqsoSjJa1G2Ymh_RY_sFZLLXAcrmpbzdWIAkgkHSZTaliL6g57vA7gxvd8L4s82wgGer_JmURI0ECbaCg98JVS0Srtf9GeTRHoX4foLWKc1Vq6NHthzqRMLZe-aRBNU9IMvXNd7kCcIbHCM3GTD_8cFj135nBPP2HOgC_ZXI1txsEf-djqJj8W5vaM7ViKU28IDv1gZGH3CatoysYx6jv1XJVvb2PH8RbFKbJmeyUm3Wvo-rgQ','dp':'YNjVBTCIwZD65WCht5ve06vnBLP_Po1NtL_4lkholmPzJ5jbLYBU8f5foNp8DVJBdFQW7wcLmx85-NC5Pl1ZeyA-Ecbw4fDraa5Z4wUKlF0LT6VV79rfOF19y8kwf6MigyrDqMLcH_CRnRGg5NfDsijlZXffINGuxg6wWzhiqqE','dq':'LfMDQbvTFNngkZjKkN2CBh5_MBG6Yrmfy4kWA8IC2HQqID5FtreiY2MTAwoDcoINfh3S5CItpuq94tlB2t-VUv8wunhbngHiB5xUprwGAAnwJ3DL39D2m43i_3YP-UO1TgZQUAOh7Jrd4foatpatTvBtY3F1DrCrUKE5Kkn770M','e':'AQAB','kid':'ZzAjSnraU3bkWGnnAqLapYGpTyNfLbjbzgAPbbW2GEA','kty':'RSA','n':'wWwQFtSzeRjjerpEM5Rmqz_DsNaZ9S1Bw6UbZkDLowuuTCjBWUax0vBMMxdy6XjEEK4Oq9lKMvx9JzjmeJf1knoqSNrox3Ka0rnxXpNAz6sATvme8p9mTXyp0cX4lF4U2J54xa2_S9NF5QWvpXvBeC4GAJx7QaSw4zrUkrc6XyaAiFnLhQEwKJCwUw4NOqIuYvYp_IXhw-5Ti_icDlZS-282PcccnBeOcX7vc21pozibIdmZJKqXNsL1Ibx5Nkx1F1jLnekJAmdaACDjYRLL_6n3W4wUp19UvzB1lGtXcJKLLkqB6YDiZNu16OSiSprfmrRXvYmvD8m6Fnl5aetgKw','p':'7enorp9Pm9XSHaCvQyENcvdU99WCPbnp8vc0KnY_0g9UdX4ZDH07JwKu6DQEwfmUA1qspC-e_KFWTl3x0-I2eJRnHjLOoLrTjrVSBRhBMGEH5PvtZTTThnIY2LReH-6EhceGvcsJ_MhNDUEZLykiH1OnKhmRuvSdhi8oiETqtPE','q':'0CBLGi_kRPLqI8yfVkpBbA9zkCAshgrWWn9hsq6a7Zl2LcLaLBRUxH0q1jWnXgeJh9o5v8sYGXwhbrmuypw7kJ0uA3OgEzSsNvX5Ay3R9sNel-3Mqm8Me5OfWWvmTEBOci8RwHstdR-7b9ZT13jk-dsZI7OlV_uBja1ny9Nz9ts','qi':'pG6J4dcUDrDndMxa-ee1yG4KjZqqyCQcmPAfqklI2LmnpRIjcK78scclvpboI3JQyg6RCEKVMwAhVtQM6cBcIO3JrHgqeYDblp5wXHjto70HVW6Z8kBruNx1AH9E8LzNvSRL-JVTFzBkJuNgzKQfD0G77tQRgJ-Ri7qu3_9o1M4'}
158+
"""
159+
{
160+
"d":"GmiaucNIzdvsEzGjZjd43SDToy1pz-Ph-shsOUXXh-dsYNGftITGerp8bO1iryXh_zUEo8oDK3r1y4klTonQ6bLsWw4ogjLPmL3yiqsoSjJa1G2Ymh_RY_sFZLLXAcrmpbzdWIAkgkHSZTaliL6g57vA7gxvd8L4s82wgGer_JmURI0ECbaCg98JVS0Srtf9GeTRHoX4foLWKc1Vq6NHthzqRMLZe-aRBNU9IMvXNd7kCcIbHCM3GTD_8cFj135nBPP2HOgC_ZXI1txsEf-djqJj8W5vaM7ViKU28IDv1gZGH3CatoysYx6jv1XJVvb2PH8RbFKbJmeyUm3Wvo-rgQ",
161+
"dp":"YNjVBTCIwZD65WCht5ve06vnBLP_Po1NtL_4lkholmPzJ5jbLYBU8f5foNp8DVJBdFQW7wcLmx85-NC5Pl1ZeyA-Ecbw4fDraa5Z4wUKlF0LT6VV79rfOF19y8kwf6MigyrDqMLcH_CRnRGg5NfDsijlZXffINGuxg6wWzhiqqE",
162+
"dq":"LfMDQbvTFNngkZjKkN2CBh5_MBG6Yrmfy4kWA8IC2HQqID5FtreiY2MTAwoDcoINfh3S5CItpuq94tlB2t-VUv8wunhbngHiB5xUprwGAAnwJ3DL39D2m43i_3YP-UO1TgZQUAOh7Jrd4foatpatTvBtY3F1DrCrUKE5Kkn770M",
163+
"e":"AQAB",
164+
"kid":"ZzAjSnraU3bkWGnnAqLapYGpTyNfLbjbzgAPbbW2GEA",
165+
"kty":"RSA",
166+
"n":"wWwQFtSzeRjjerpEM5Rmqz_DsNaZ9S1Bw6UbZkDLowuuTCjBWUax0vBMMxdy6XjEEK4Oq9lKMvx9JzjmeJf1knoqSNrox3Ka0rnxXpNAz6sATvme8p9mTXyp0cX4lF4U2J54xa2_S9NF5QWvpXvBeC4GAJx7QaSw4zrUkrc6XyaAiFnLhQEwKJCwUw4NOqIuYvYp_IXhw-5Ti_icDlZS-282PcccnBeOcX7vc21pozibIdmZJKqXNsL1Ibx5Nkx1F1jLnekJAmdaACDjYRLL_6n3W4wUp19UvzB1lGtXcJKLLkqB6YDiZNu16OSiSprfmrRXvYmvD8m6Fnl5aetgKw",
167+
"p":"7enorp9Pm9XSHaCvQyENcvdU99WCPbnp8vc0KnY_0g9UdX4ZDH07JwKu6DQEwfmUA1qspC-e_KFWTl3x0-I2eJRnHjLOoLrTjrVSBRhBMGEH5PvtZTTThnIY2LReH-6EhceGvcsJ_MhNDUEZLykiH1OnKhmRuvSdhi8oiETqtPE",
168+
"q":"0CBLGi_kRPLqI8yfVkpBbA9zkCAshgrWWn9hsq6a7Zl2LcLaLBRUxH0q1jWnXgeJh9o5v8sYGXwhbrmuypw7kJ0uA3OgEzSsNvX5Ay3R9sNel-3Mqm8Me5OfWWvmTEBOci8RwHstdR-7b9ZT13jk-dsZI7OlV_uBja1ny9Nz9ts",
169+
"qi":"pG6J4dcUDrDndMxa-ee1yG4KjZqqyCQcmPAfqklI2LmnpRIjcK78scclvpboI3JQyg6RCEKVMwAhVtQM6cBcIO3JrHgqeYDblp5wXHjto70HVW6Z8kBruNx1AH9E8LzNvSRL-JVTFzBkJuNgzKQfD0G77tQRgJ-Ri7qu3_9o1M4"
170+
}
171+
"""
145172
</pre>
146173
</li>
147174
</ul>

0 commit comments

Comments
 (0)