Skip to content

Commit 6bc3c61

Browse files
maartenbamaartenba
authored
Merge pull request #808 from DuendeSoftware/release/im-7.1
IdentityModel 7.1
2 parents 0aae142 + d9f392b commit 6bc3c61

File tree

6 files changed

+241
-88
lines changed

6 files changed

+241
-88
lines changed

‎src/content/docs/identitymodel/endpoints/discovery.md

Lines changed: 58 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,22 @@ description: Documentation for using the OpenID Connect discovery endpoint clien
44
sidebar:
55
order: 2
66
label: Discovery
7+
badge:
8+
text: v7.1
9+
variant: tip
710
redirect_from:
811
- /foss/identitymodel/endpoints/discovery/
912
---
1013

1114
The client library for the [OpenID Connect discovery
1215
endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html) is
1316
provided as an extension method for `HttpClient`. The
14-
`GetDiscoveryDocumentAsync` method returns a `DiscoveryResponse` object
17+
`GetDiscoveryDocumentAsync` method returns a `DiscoveryDocumentResponse` object
1518
that has both strong and weak typed accessors for the various elements
1619
of the discovery document.
1720

1821
You should always check the `IsError` and `Error` properties before
19-
accessing the contents of the document.
20-
21-
Example:
22+
accessing the contents of the document:
2223

2324
```csharp
2425
var client = new HttpClient();
@@ -27,7 +28,7 @@ var disco = await client.GetDiscoveryDocumentAsync("https://demo.duendesoftware.
2728
if (disco.IsError) throw new Exception(disco.Error);
2829
```
2930

30-
Standard elements can be accessed by using properties:
31+
[Standard elements](#discoverydocumentresponse-properties-reference) can be accessed by using properties:
3132

3233
```csharp
3334
var tokenEndpoint = disco.TokenEndpoint;
@@ -61,7 +62,7 @@ By default, the discovery response is validated before it is returned to the cli
6162
- enforce the existence of a keyset
6263

6364
Policy violation errors will set the `ErrorType` property on the
64-
`DiscoveryResponse` to `PolicyViolation`.
65+
`DiscoveryDocumentResponse` to `PolicyViolation`.
6566

6667
All the standard validation rules can be modified using the
6768
`DiscoveryPolicy` class, e.g. disabling the issuer name check:
@@ -148,3 +149,54 @@ services.AddSingleton<IDiscoveryCache>(r =>
148149
return new DiscoveryCache(Constants.Authority, () => factory.CreateClient());
149150
});
150151
```
152+
153+
### DiscoveryDocumentResponse Properties Reference
154+
155+
The following table lists the standard properties on the `DiscoveryDocumentResponse` class:
156+
157+
| Property | Description |
158+
|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
159+
| Policy | Gets or sets the discovery policy used to configure how the discovery document is processed |
160+
| KeySet | Gets or sets the JSON Web Key Set (JWKS) associated with the discovery document |
161+
| MtlsEndpointAliases | Gets the mutual TLS (mTLS) endpoint aliases |
162+
| Issuer | Gets the issuer identifier for the authorization server |
163+
| AuthorizeEndpoint | Gets the authorization endpoint URL |
164+
| TokenEndpoint | Gets token endpoint URL |
165+
| UserInfoEndpoint | Gets user info endpoint URL |
166+
| IntrospectionEndpoint | Gets the introspection endpoint URL |
167+
| RevocationEndpoint | Gets the revocation endpoint URL |
168+
| DeviceAuthorizationEndpoint | Gets the device authorization endpoint URL |
169+
| BackchannelAuthenticationEndpoint | Gets the backchannel authentication endpoint URL |
170+
| JwksUri | Gets the URI of the JSON Web Key Set (JWKS) |
171+
| EndSessionEndpoint | Gets the end session endpoint URL |
172+
| CheckSessionIframe | Gets the check session iframe URL |
173+
| RegistrationEndpoint | Gets the dynamic client registration (DCR) endpoint URL |
174+
| PushedAuthorizationRequestEndpoint | Gets the pushed authorization request (PAR) endpoint URL |
175+
| FrontChannelLogoutSupported | Gets a flag indicating whether front-channel logout is supported |
176+
| FrontChannelLogoutSessionSupported | Gets a flag indicating whether a session ID (sid) parameter is supported at the front-channel logout endpoint |
177+
| GrantTypesSupported | Gets the supported grant types |
178+
| CodeChallengeMethodsSupported | Gets the supported code challenge methods |
179+
| ScopesSupported | Gets the supported scopes |
180+
| SubjectTypesSupported | Gets the supported subject types |
181+
| ResponseModesSupported | Gets the supported response modes |
182+
| ResponseTypesSupported | Gets the supported response types |
183+
| ClaimsSupported | Gets the supported claims |
184+
| TokenEndpointAuthenticationMethodsSupported | Gets the authentication methods supported by the token endpoint |
185+
| TokenEndpointAuthenticationSigningAlgorithmsSupported | Gets the signing algorithms supported by the token endpoint for client authentication |
186+
| BackchannelTokenDeliveryModesSupported | Gets the supported backchannel token delivery modes |
187+
| BackchannelUserCodeParameterSupported | Gets a flag indicating whether the backchannel user code parameter is supported |
188+
| RequirePushedAuthorizationRequests | Gets a flag indicating whether the use of pushed authorization requests (PAR) is required |
189+
| IntrospectionSigningAlgorithmsSupported | Gets the signing algorithms supported for introspection responses |
190+
| IntrospectionEncryptionAlgorithmsSupported | Gets the encryption "alg" values supported for encrypted JWT introspection responses |
191+
| IntrospectionEncryptionEncValuesSupported | Gets the encryption "enc" values supported for encrypted JWT introspection responses |
192+
| Scopes | The list of scopes associated to the token or an empty array if no `scope` claim is present |
193+
| ClientId | The client identifier for the OAuth 2.0 client that requested the token or `null` if the `client_id` claim is missing |
194+
| UserName | The human-readable identifier for the resource owner who authorized the token or `null` if the `username` claim is missing |
195+
| TokenType | The type of the token as defined in section 5.1 of OAuth 2.0 (RFC6749) or `null` if the `token_type` claim is missing |
196+
| Expiration | The expiration time of the token or `null` if the `exp` claim is missing |
197+
| IssuedAt | The issuance time of the token or `null` if the `iat` claim is missing |
198+
| NotBefore | The validity start time of the token or `null` if the `nbf` claim is missing |
199+
| Subject | The subject of the token or `null` if the `sub` claim is missing |
200+
| Audiences | The service-specific list of string identifiers representing the intended audience for the token or an empty array if no `aud` claim is present |
201+
| Issuer | The string representing the issuer of the token or `null` if the `iss` claim is missing |
202+
| JwtId | The string identifier for the token or `null` if the `jti` claim is missing |

‎src/content/docs/identitymodel/endpoints/general-usage.md

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ the client for the token endpoint.
1717
## Request and response objects
1818

1919

20-
All protocol request are modelled as request objects and have a common
21-
base class called *ProtocolRequest* which has properties to set the
20+
All protocol request are modeled as request objects and have a common
21+
base class called `ProtocolRequest` which has properties to set the
2222
endpoint address, client ID, client secret, client assertion, and the
2323
details of how client secrets are transmitted (e.g. authorization header
24-
vs POST body). *ProtocolRequest* derives from *HttpRequestMessage* and
24+
vs POST body). `ProtocolRequest` derives from `HttpRequestMessage` and
2525
thus also allows setting custom headers etc.
2626

2727
The following code snippet creates a request for a client credentials
@@ -36,16 +36,16 @@ var request = new ClientCredentialsTokenRequest
3636
};
3737
```
3838

39-
While in theory you could now call *Prepare* (which internally sets the
39+
While in theory you could now call `Prepare` (which internally sets the
4040
headers, body and address) and send the request via a plain
41-
*HttpClient*, typically there are more parameters with special semantics
41+
`HttpClient`, typically there are more parameters with special semantics
4242
and encoding required. That's why we provide extension methods to do
4343
the low level work.
4444

45-
Equally, a protocol response has a corresponding *ProtocolResponse*
45+
Equally, a protocol response has a corresponding `ProtocolResponse`
4646
implementation that parses the status codes and response content. The
4747
following code snippet would parse the raw HTTP response from a token
48-
endpoint and turn it into a *TokenResponse* object:
48+
endpoint and turn it into a `TokenResponse` object:
4949

5050
```cs
5151
var tokenResponse = await ProtocolResponse
@@ -58,12 +58,12 @@ have a look at an example next.
5858
## Extension methods
5959

6060
For each protocol interaction, an extension method for
61-
*HttpMessageInvoker* (that's the base class of *HttpClient*) exists.
61+
`HttpMessageInvoker` (that's the base class of `HttpClient`) exists.
6262
The extension methods expect a request object and return a response
6363
object.
6464

6565
It is your responsibility to set up and manage the lifetime of the
66-
*HttpClient*, e.g. manually:
66+
`HttpClient`, e.g. manually:
6767

6868
```cs
6969
var client = new HttpClient();
@@ -77,7 +77,7 @@ var response = await client.RequestClientCredentialsTokenAsync(
7777
});
7878
```
7979

80-
You might want to use other techniques to obtain an *HttpClient*, e.g.
80+
You might want to use other techniques to obtain an `HttpClient`, e.g.
8181
via the HTTP client factory:
8282

8383
```cs
@@ -96,7 +96,7 @@ All other endpoint client follow the same design.
9696

9797
:::note
9898
Some client libraries also include a stateful client object (e.g.
99-
*TokenClient* and *IntrospectionClient*). See the corresponding section
99+
`TokenClient` and `IntrospectionClient`). See the corresponding section
100100
to find out more.
101101
:::
102102

@@ -108,9 +108,9 @@ HTTP Basic authentication encoding issues.
108108
:::
109109

110110

111-
Any request type implementing *ProtocolRequest* has the ability to configure
111+
Any request type implementing `ProtocolRequest` has the ability to configure
112112
the client credential style, which specifies how the client will transmit the client ID and secret.
113-
*ClientCredentialStyle* options include *PostBody* and the default value of *AuthorizationHeader*.
113+
`ClientCredentialStyle` options include `PostBody` and the default value of `AuthorizationHeader`.
114114

115115
```cs
116116
var client = HttpClientFactory.CreateClient("my_named_token_client");
@@ -131,7 +131,7 @@ specification version you are targeting. When using IdentityServer, both header
131131
are supported and _"it just works"_.
132132

133133
[RFC 6749](https://datatracker.ietf.org/doc/rfc6749/), the original OAuth spec, says that support for the basic auth header is mandatory,
134-
and that the POST body is optional. OAuth 2.1 reverses this - now the body is mandatory and the header is optional.
134+
and that the POST body is optional. OAuth 2.1 reverses this: now the body is mandatory and the header is optional.
135135

136136
In the previous OAuth specification version, the header caused bugs and interoperability problems. To follow
137137
both RFC 6749 and RFC 2617 (which is where basic auth headers are specified), you have to form url encode the client id and client secret,
@@ -145,22 +145,22 @@ References:
145145
- [RFC 2617 section 2](https://www.rfc-editor.org/rfc/rfc2617#section-2)
146146
- [OAuth 2.1 Draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/)
147147

148-
Here is a complete list of *ProtocolRequest* implementors that expose the *ClientCredentialStyle* option:
149-
150-
- *Duende.IdentityModel.Client.AuthorizationCodeTokenRequest*
151-
- *Duende.IdentityModel.Client.BackchannelAuthenticationRequest*
152-
- *Duende.IdentityModel.Client.BackchannelAuthenticationTokenRequest*
153-
- *Duende.IdentityModel.Client.ClientCredentialsTokenRequest*
154-
- *Duende.IdentityModel.Client.DeviceAuthorizationRequest*
155-
- *Duende.IdentityModel.Client.DeviceTokenRequest*
156-
- *Duende.IdentityModel.Client.DiscoveryDocumentRequest*
157-
- *Duende.IdentityModel.Client.DynamicClientRegistrationRequest*
158-
- *Duende.IdentityModel.Client.JsonWebKeySetRequest*
159-
- *Duende.IdentityModel.Client.PasswordTokenRequest*
160-
- *Duende.IdentityModel.Client.PushedAuthorizationRequest*
161-
- *Duende.IdentityModel.Client.RefreshTokenRequest*
162-
- *Duende.IdentityModel.Client.TokenExchangeTokenRequest*
163-
- *Duende.IdentityModel.Client.TokenIntrospectionRequest*
164-
- *Duende.IdentityModel.Client.TokenRequest*
165-
- *Duende.IdentityModel.Client.TokenRevocationRequest*
166-
- *Duende.IdentityModel.Client.UserInfoRequest*
148+
Here is a complete list of `ProtocolRequest` implementors that expose the `ClientCredentialStyle` option:
149+
150+
- `Duende.IdentityModel.Client.AuthorizationCodeTokenRequest`
151+
- `Duende.IdentityModel.Client.BackchannelAuthenticationRequest`
152+
- `Duende.IdentityModel.Client.BackchannelAuthenticationTokenRequest`
153+
- `Duende.IdentityModel.Client.ClientCredentialsTokenRequest`
154+
- `Duende.IdentityModel.Client.DeviceAuthorizationRequest`
155+
- `Duende.IdentityModel.Client.DeviceTokenRequest`
156+
- `Duende.IdentityModel.Client.DiscoveryDocumentRequest`
157+
- `Duende.IdentityModel.Client.DynamicClientRegistrationRequest`
158+
- `Duende.IdentityModel.Client.JsonWebKeySetRequest`
159+
- `Duende.IdentityModel.Client.PasswordTokenRequest`
160+
- `Duende.IdentityModel.Client.PushedAuthorizationRequest`
161+
- `Duende.IdentityModel.Client.RefreshTokenRequest`
162+
- `Duende.IdentityModel.Client.TokenExchangeTokenRequest`
163+
- `Duende.IdentityModel.Client.TokenIntrospectionRequest`
164+
- `Duende.IdentityModel.Client.TokenRequest`
165+
- `Duende.IdentityModel.Client.TokenRevocationRequest`
166+
- `Duende.IdentityModel.Client.UserInfoRequest`

‎src/content/docs/identitymodel/endpoints/introspection.md

Lines changed: 0 additions & 43 deletions
This file was deleted.

0 commit comments

Comments
 (0)