Class AzureADOboTokenProvider

Namespace

Arc4u.OAuth2.TokenProviders

Assembly

Arc4u.OAuth2.AspNetCore.Authentication.dll

An ITokenProvider that exchanges the access token of the current user for a token for another API, with the on-behalf-of flow (urn:ietf:params:oauth:grant-type:jwt-bearer). The user token is the access token of the scoped TokenRefreshInfo (the OpenID Connect session) or, if empty, the BootstrapContext of the current principal (the bearer token of the request). The ClientId, ClientSecret and Scope come from the settings (see OnBehalfOfSettingsOptions) and the request goes to the token endpoint of the Default authority. The resulting token is cached until it expires.

[Export("Obo", typeof(ITokenProvider))]
public class AzureADOboTokenProvider : ISignOutTokenProvider, ITokenProvider

Inheritance

object

AzureADOboTokenProvider

Implements

ISignOutTokenProvider

ITokenProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

AzureADOboTokenProvider(TokenRefreshInfo, ICacheHelper, IActivitySourceFactory, IApplicationContext, IOptionsMonitor<AuthorityOptions>, ILogger<AzureADOboTokenProvider>, IUserObjectIdentifier?)

An ITokenProvider that exchanges the access token of the current user for a token for another API, with the on-behalf-of flow (urn:ietf:params:oauth:grant-type:jwt-bearer). The user token is the access token of the scoped TokenRefreshInfo (the OpenID Connect session) or, if empty, the BootstrapContext of the current principal (the bearer token of the request). The ClientId, ClientSecret and Scope come from the settings (see OnBehalfOfSettingsOptions) and the request goes to the token endpoint of the Default authority. The resulting token is cached until it expires.

public AzureADOboTokenProvider(TokenRefreshInfo tokenRefreshInfo, ICacheHelper cacheHelper, IActivitySourceFactory activitySourceFactory, IApplicationContext applicationContext, IOptionsMonitor<AuthorityOptions> authorities, ILogger<AzureADOboTokenProvider> logger, IUserObjectIdentifier? userObjectIdentifier = null)

Parameters

tokenRefreshInfo TokenRefreshInfo

The scoped access and refresh tokens of the user.

cacheHelper ICacheHelper

The helper giving access to the token cache.

activitySourceFactory IActivitySourceFactory

The factory of the activity source used for telemetry.

applicationContext IApplicationContext

The application context giving the current principal.

authorities IOptionsMonitor<AuthorityOptions>

The named authority options.

logger ILogger<AzureADOboTokenProvider>

The logger.

userObjectIdentifier IUserObjectIdentifier

When registered, identifies the user of the index of the cached tokens from the claims configured in ClaimsIdentifierOption, as the claims cache does; otherwise the user is identified by the oid (or sub) claim of the token.

Fields

ProviderName

The key (Obo) under which the provider is registered.

public const string ProviderName = "Obo"

Field Value

string

Methods

GetTokenAsync(IKeyValueSettings?, object?)

Gets a token for the API designated by the settings, on behalf of the current user.

public ValueTask<Result<TokenInfo>> GetTokenAsync(IKeyValueSettings? settings, object? _)

Parameters

settings IKeyValueSettings

The on-behalf-of settings (client id, client secret and scope).

_ object

Not used.

Returns

ValueTask<Result<TokenInfo>>

The token, or a failed result when there is no principal or no token for the user.

Exceptions

ArgumentNullException

settings is null.

HttpRequestException

The token endpoint does not answer with a success status code.

SignOutAsync(IKeyValueSettings, CancellationToken)

Removes from the cache all the on-behalf-of tokens obtained for the current user, whatever the settings (API) and the user access token (before or after a refresh) they were obtained with: the keys are read from the OboTokenCacheIndex of the user. Nothing is done when there is no token for the user. A key that cannot be removed is logged and kept in the index, so a next sign-out of the user removes it.

public ValueTask SignOutAsync(IKeyValueSettings settings, CancellationToken cancellationToken)

Parameters

settings IKeyValueSettings

Not used: the tokens of every on-behalf-of settings are removed.

cancellationToken CancellationToken

A token to cancel the operation.

Returns

ValueTask

A task that completes when the tokens are removed from the cache.