dotnet / dotnet/aspnetcore

Opaque - reference token validation

Open
#46,026 13 comments 4 reactions 0 assignees View on GitHub
area-auth enhancement Needs: Design
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Hi,

I have an identity provider OIDC compliant which issues a JWT ID token and an opaque access token (or reference token).
Microsoft offers a way to validate a JWT bearer however, I did not see an alternative for opaque tokens.

### Describe the solution you'd like

I would like to have a method extension that works the same as `ServiceCollection.AddJwtBearer()` extension.

We would provide almost the same identity provider information such as the issuer uri, user info, and most importantly the **introspect endpoint**, which checks if the access token is valid or not.

Finally, we could populate the identity principal with the userinfo endpoint, right after validating the token.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.