Interface IOidcExchangeService

Namespace

SEBT.Portal.Core.Services

Assembly

SEBT.Portal.Core.dll

Performs the OIDC token exchange and id_token verification entirely server-side. The implementation owns the IdP HTTP calls, JWKS validation, and callback-token signing/validation; UseCases handlers orchestrate it without seeing any of that.

Implementations are stateless between requests (all flow state lives in the pre-auth session store). Inject as scoped or transient.

public interface IOidcExchangeService

Methods

ExchangeCodeAsync(string, string, string, bool, string?, CancellationToken)

Exchanges an authorization code for an id_token, verifies it, and signs a short-lived callback token containing the IdP claims. Returns the callback token on success.

Task<OidcExchangeResult> ExchangeCodeAsync(string code, string codeVerifier, string redirectUri, bool isStepUp, string? sessionId = null, CancellationToken cancellationToken = default)

Parameters

code string

Authorization code from PingOne redirect.

codeVerifier string

PKCE code_verifier (from the pre-auth session, never from the browser).

redirectUri string

redirect_uri that was sent in the authorization request.

isStepUp bool

True when this is a step-up (IAL1+) flow.

sessionId string

Pre-auth session id for correlated off-boarding logs.

cancellationToken CancellationToken

Cancellation.

Returns

Task<OidcExchangeResult>

Signed callback token (short-lived JWT) on success.

GetDiscoveryInfoAsync(bool, CancellationToken)

Fetches the endpoints the portal needs from the cached OIDC discovery document for the configured IdP. Throws when OIDC is not configured or the discovery document cannot be loaded — callers decide how to degrade.

Task<OidcDiscoveryInfo> GetDiscoveryInfoAsync(bool isStepUp, CancellationToken cancellationToken = default)

Parameters

isStepUp bool

True to use the step-up IdP configuration.

cancellationToken CancellationToken

Cancellation.

Returns

Task<OidcDiscoveryInfo>

ValidateCallbackToken(string)

Validates a callback token previously signed by ExchangeCodeAsync(string, string, string, bool, string?, CancellationToken) (signature, issuer, audience, lifetime) and returns its claims. Signing and validation share one implementation so the key and issuer/audience rules can never drift apart.

OidcCallbackTokenResult ValidateCallbackToken(string callbackToken)

Parameters

callbackToken string

Returns

OidcCallbackTokenResult