OpenIdDict 3 (16.12.2022 M)

Question 1

What is the idea of endpoints passthrough?

Answer 1

OpenIdDict works in a next way:

when any request is coming OpenIdDict hooks it inside Authentication middleware and checks if it’s related to Oauth + OpenId endpoints, if yes then it validates the request, populates its context (properties like issuer, client id, etc.) and if it is valid, passthrough it to subsequent middlewares to allow more high-level processing.

If the request is not valid, it stops the pipeline and returns with the error like in Oauth documentation.

Note: you have to enable passthrough for every endpoint explicitly if you don’t do this further processing of request after the validation will be blocked.

Question 2

What are the options of high-level processing of OAuth + OpenId connect endpoints?

Answer 2

There are three options:
- Enable passthrough and handle a request in subsequent middleware.
- Enable passthrough and implement controller action to handle the request (actually this is like a special case of the previous one)
- Register IOpenIddictServerHandler with a context, specific for the request, e.g. IOpenIddictServerHandler<HandleTokenRequestContext></HandleTokenRequestContext>

Question 3

How to register your own IOpenIddictServerHandler?

Answer 3

You can do it during configuration within AddServer, using AddEventHandler.

Question 4

What do you need to do in controller action for the token?

Answer 4

You just need to build ClaimPrincipal, everything else is done by OpenIdDict, including validation of client_id, client_secret, authorization code and etc.

Question 5

What is claim destination in OpenIdDict?

Answer 5

When you are building the identity for OpenIdDict, you are adding new claims with extensions method AddClaim on ClaimsIdentity.
This extension method is provided by OpenIdDict and contains possibility to add destinations. Destination are just set as Properties of the Claim. There are two destination access_token and id_token. Depending on destination OpenIdDict decides where Claim will be assigned to particular token. You don’t need to setup a destination for claims required in both tokens like sub.

Question 6

How to setup scopes on token?

Answer 6

You can do it using SetScopes extension method on ClaimsPrinicpal. It’s also provided by OpenIdDict. And allows to work with scopes as enumerable, rather than white space separated string.