Class OidcExchangeService

Namespace

SEBT.Portal.Infrastructure.Services

Assembly

SEBT.Portal.Infrastructure.dll

performs the OIDC token exchange and id_token verification entirely server-side. The client secret, JWKS validation, and callback-token signing all happen here; UseCases handlers orchestrate the flow through IOidcExchangeService.

The service is stateless between requests (all flow state lives in the pre-auth session store). Inject as scoped or transient.

public sealed class OidcExchangeService : IOidcExchangeService

Inheritance

object

OidcExchangeService

Implements

IOidcExchangeService

Constructors

OidcExchangeService(IOptionsSnapshot<OidcSettings>, IOptionsSnapshot<OidcStepUpSettings>, IHttpClientFactory, ILogger<OidcExchangeService>, IOidcCallbackFailureLogger)

performs the OIDC token exchange and id_token verification entirely server-side. The client secret, JWKS validation, and callback-token signing all happen here; UseCases handlers orchestrate the flow through IOidcExchangeService.

The service is stateless between requests (all flow state lives in the pre-auth session store). Inject as scoped or transient.

public OidcExchangeService(IOptionsSnapshot<OidcSettings> oidcSettings, IOptionsSnapshot<OidcStepUpSettings> oidcStepUpSettings, IHttpClientFactory httpFactory, ILogger<OidcExchangeService> logger, IOidcCallbackFailureLogger callbackFailureLogger)

Parameters

oidcSettings IOptionsSnapshot<OidcSettings>

oidcStepUpSettings IOptionsSnapshot<OidcStepUpSettings>

httpFactory IHttpClientFactory

logger ILogger<OidcExchangeService>

callbackFailureLogger IOidcCallbackFailureLogger

Methods

ExchangeCodeAsync(string, string, string, bool, string?, CancellationToken)

Exchanges an authorization code for an id_token, verifies it, and signs a short-lived callback token containing the IdP claims. Returns the callback token on success.

public Task<OidcExchangeResult> ExchangeCodeAsync(string code, string codeVerifier, string redirectUri, bool isStepUp, string? sessionId = null, CancellationToken cancellationToken = default)

Parameters

code string

Authorization code from PingOne redirect.

codeVerifier string

PKCE code_verifier (from the pre-auth session, never from the browser).

redirectUri string

redirect_uri that was sent in the authorization request.

isStepUp bool

True when this is a step-up (IAL1+) flow.

sessionId string

Pre-auth session id for correlated off-boarding logs.

cancellationToken CancellationToken

Cancellation.

Returns

Task<OidcExchangeResult>

Signed callback token (short-lived JWT) on success.

GetDiscoveryConfigAsync(bool, CancellationToken)

Fetches the cached OIDC discovery document for the configured IdP. Returns the Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration containing endpoint URLs (authorization, token, userinfo), signing keys, and issuer metadata.

public Task<OpenIdConnectConfiguration> GetDiscoveryConfigAsync(bool isStepUp, CancellationToken cancellationToken = default)

Parameters

isStepUp bool

True to use the step-up IdP configuration.

cancellationToken CancellationToken

Cancellation.

Returns

Task<OpenIdConnectConfiguration>

GetDiscoveryInfoAsync(bool, CancellationToken)

Fetches the endpoints the portal needs from the cached OIDC discovery document for the configured IdP. Throws when OIDC is not configured or the discovery document cannot be loaded — callers decide how to degrade.

public Task<OidcDiscoveryInfo> GetDiscoveryInfoAsync(bool isStepUp, CancellationToken cancellationToken = default)

Parameters

isStepUp bool

True to use the step-up IdP configuration.

cancellationToken CancellationToken

Cancellation.

Returns

Task<OidcDiscoveryInfo>

ValidateCallbackToken(string)

Validates a callback token previously signed by ExchangeCodeAsync(string, string, string, bool, string?, CancellationToken) (signature, issuer, audience, lifetime) and returns its claims. Signing and validation share one implementation so the key and issuer/audience rules can never drift apart.

public OidcCallbackTokenResult ValidateCallbackToken(string callbackToken)

Parameters

callbackToken string

Returns

OidcCallbackTokenResult