/// <summary>
/// Called when a request to the Token endpoint arrives with a "grant_type" of "refresh_token".
/// This occurs if your application has issued a "refresh_token" along with the "access_token",
/// and the client is attempting to use the "refresh_token" to acquire a new "access_token",
/// and possibly a new "refresh_token". To issue a refresh token the an Options.RefreshTokenProvider
/// must be assigned to create the value which is returned. The claims and properties associated
/// with the refresh token are present in the context.Ticket. The application must call
/// context.Validated to instruct the Authorization Server middleware to issue an access token
/// based on those claims and properties. The call to context.Validated may be given a different
/// AuthenticationTicket or ClaimsIdentity in order to control which information flows from the
/// refresh token to the access token. The default behavior when using the OAuthAuthorizationServerProvider
/// is to flow information from the refresh token to the access token unmodified.
/// See also http://tools.ietf.org/html/rfc6749#section-6
/// </summary>
public async Task GrantRefreshTokenAsync(OAuthGrantRefreshTokenContext context)
{
context.AssertNotNull("context");
var originalClient = context.Ticket.Properties.Dictionary[Core.Constants.TokenClientIdKey];
var currentClient = context.ClientId;
if (originalClient != currentClient)
{
context.SetError("invalid_clientId", "Refresh token is issued to a different clientId.");
return;
}
var nameIdentifierClaim = context.Ticket.Identity.FindFirst(ClaimTypes.NameIdentifier);
var userId = new UserId(nameIdentifierClaim.Value.DecodeGuid());
UserClaimsIdentity userClaimsIdentity;
try
{
userClaimsIdentity = await this.getUserClaimsIdentity.HandleAsync(
new GetUserClaimsIdentityQuery(userId, null, null, context.Options.AuthenticationType));
}
catch (BadRequestException t)
{
context.SetError("invalid_grant", t.Message);
return;
}
await this.updateLastAccessTokenDate.HandleAsync(
new UpdateLastAccessTokenDateCommand(userId, DateTime.UtcNow, UpdateLastAccessTokenDateCommand.AccessTokenCreationType.RefreshToken));
var props = this.CreateAuthenticationProperties(context.ClientId, userClaimsIdentity);
var ticket = new AuthenticationTicket(userClaimsIdentity.ClaimsIdentity, props);
context.Validated(ticket);
}