public Task <ResourceValidationResult> ValidateRequestedResourcesAsync(ResourceValidationRequest request)
{
var resource = new IdentityServer4.Models.Resources();
resource.OfflineAccess = true;
resource.IdentityResources.Add(new IdentityServer4.Models.IdentityResource
{
Name = "openid",
DisplayName = "openid"
});
resource.IdentityResources.Add(new IdentityServer4.Models.IdentityResource
{
Name = "profile",
DisplayName = "profile"
});
resource.ApiResources.Add(new IdentityServer4.Models.ApiResource
{
Name = "PagetechsLMS.WebAndApiAPI",
DisplayName = "PagetechsLMS.WebAndApiAPI"
});
resource.ApiScopes.Add(new IdentityServer4.Models.ApiScope
{
Name = "PagetechsLMS.WebAndApiAPI",
DisplayName = "PagetechsLMS.WebAndApiAPI"
});
var result = new ResourceValidationResult(resource);
return(Task.FromResult(result));
}
public Task <ResourceValidationResult> ValidateRequestedResourcesAsync(ResourceValidationRequest request)
{
return(Task.FromResult(Result));
}
/// <inheritdoc/>
public virtual async Task <ResourceValidationResult> ValidateRequestedResourcesAsync(ResourceValidationRequest request)
{
using var activity = Tracing.ValidationActivitySource.StartActivity("DefaultResourceValidator.ValidateRequestedResources");
activity?.SetTag(Tracing.Properties.Scope, request.Scopes.ToSpaceSeparatedString());
activity?.SetTag(Tracing.Properties.Resource, request.ResourceIndicators.ToSpaceSeparatedString());
if (request == null)
{
throw new ArgumentNullException(nameof(request));
}
var result = new ResourceValidationResult();
var parsedScopesResult = _scopeParser.ParseScopeValues(request.Scopes);
if (!parsedScopesResult.Succeeded)
{
foreach (var invalidScope in parsedScopesResult.Errors)
{
_logger.LogError("Invalid parsed scope {scope}, message: {error}", invalidScope.RawValue, invalidScope.Error);
result.InvalidScopes.Add(invalidScope.RawValue);
}
return(result);
}
var scopeNames = parsedScopesResult.ParsedScopes.Select(x => x.ParsedName).Distinct().ToArray();
// todo: this API might want to pass resource indicators to better filter
var scopeResourcesFromStore = await _store.FindEnabledResourcesByScopeAsync(scopeNames);
if (request.ResourceIndicators?.Any() == true)
{
// remove isolated API resources not included in the requested resource indicators
scopeResourcesFromStore.ApiResources = scopeResourcesFromStore.ApiResources
.Where(x =>
// only allow non-isolated resources if the request could produce multiple access
// tokens. this will happen if the request is for a RT, so check for offline_access
(request.IncludeNonIsolatedApiResources && !x.RequireResourceIndicator) ||
request.ResourceIndicators.Contains(x.Name))
.ToHashSet();
if (!request.IncludeNonIsolatedApiResources)
{
// filter API scopes that don't match the resources requested
var allResourceScopes = scopeResourcesFromStore.ApiResources.SelectMany(x => x.Scopes).ToArray();
scopeResourcesFromStore.ApiScopes =
scopeResourcesFromStore.ApiScopes.Where(x => allResourceScopes.Contains(x.Name))
.ToHashSet();
}
// find requested resource indicators not matched by scope
var matchedApiResourceNames = scopeResourcesFromStore.ApiResources.Select(x => x.Name).ToArray();
var invalidRequestedResourceIndicators = request.ResourceIndicators.Except(matchedApiResourceNames);
if (invalidRequestedResourceIndicators.Any())
{
foreach (var invalid in invalidRequestedResourceIndicators)
{
_logger.LogError("Invalid resource identifier {resource}. It is either not found, not enabled, or does not support any of the requested scopes.", invalid);
result.InvalidResourceIndicators.Add(invalid);
}
return(result);
}
}
else
{
// no resource indicators, so filter all API resources marked as isolated
scopeResourcesFromStore.ApiResources = scopeResourcesFromStore.ApiResources.Where(x => !x.RequireResourceIndicator).ToHashSet();
}
foreach (var scope in parsedScopesResult.ParsedScopes)
{
await ValidateScopeAsync(request.Client, scopeResourcesFromStore, scope, result);
}
if (result.InvalidScopes.Count > 0 || result.InvalidResourceIndicators.Count > 0)
{
result.Resources.IdentityResources.Clear();
result.Resources.ApiResources.Clear();
result.Resources.ApiScopes.Clear();
result.ParsedScopes.Clear();
}
return(result);
}
public virtual async Task <ResourceValidationResult> ValidateRequestedResourcesAsync(ResourceValidationRequest request)
{
if (request == null)
{
throw new ArgumentNullException("request");
}
ParsedScopesResult parsedScopesResult = _scopeParser.ParseScopeValues(request.Scopes);
ResourceValidationResult result = new ResourceValidationResult();
if (!parsedScopesResult.Succeeded)
{
foreach (ParsedScopeValidationError error in parsedScopesResult.Errors)
{
_logger.LogError("Invalid parsed scope {scope}, message: {error}", error.RawValue, error.Error);
result.InvalidScopes.Add(error.RawValue);
}
return(result);
}
string[] scopeNames = parsedScopesResult.ParsedScopes.Select((ParsedScopeValue x) => x.ParsedName).Distinct().ToArray();
Resources resourcesFromStore = await _store.FindEnabledResourcesByScopeAsync(scopeNames);
foreach (ParsedScopeValue parsedScope in parsedScopesResult.ParsedScopes)
{
await ValidateScopeAsync(request.Client, resourcesFromStore, parsedScope, result);
}
if (result.InvalidScopes.Count > 0)
{
result.Resources.IdentityResources.Clear();
result.Resources.ApiResources.Clear();
result.Resources.ApiScopes.Clear();
result.ParsedScopes.Clear();
}
return(result);
}
