在 Dot Net Framework 4.8 中使用 IdentityModel 1.9.2 和 IdentityServer3.AccessTokenValidation 的扩展授权进行委派

Question

I am unable to implement the delegate token service in the Dot Net Framework 4.8 application. Whereas I have another dot net core application where I am able to do it with the IdentityModel 4.4.1 nuget as below,

public async Task<TokenResponse> DelegateAsync(string userToken)
{
    var client = _httpClientFactory.CreateClient();
    // or
    // var client = new HttpClient();
    // send custom grant to token endpoint, return response
    return await client.RequestTokenAsync(new TokenRequest
    {
        Address = disco.TokenEndpoint,
        GrantType = "delegation",
        ClientId = "api1.client",
        ClientSecret = "secret",
        Parameters =
        {
            { "scope", "api2" },
            { "token", userToken}
        }
    });
}

My Dot Net Framework 4.8 application has a dependency on IdentityModel 1.9.2 which does not provide the extended methods like GetDiscoveryDocumentAsync() RequestTokenAsync() methods used to get the delegate token. If I try to upgrade the IdentityModel 4.4.0 latest, it is not compatible with IdentityServer3.AccessTokenValidation (My application is using this nuget for the ID4 implementation). and if we try to upgrade IdentityServer3.AccessTokenValidation to IdentityServer4.AccessTokenValidation, it is not compatible with the Dot Net Framework 4.8.

Reference: 33.1 https://docs.identityserver.io/_/downloads/en/latest/pdf/

How can I achieve the same in the dot net framework app?

Answer 1

If you're hell bent on getting the same functionality I think you'll have to do your own discovery client.

Using a normal GET to https://your-identity-server/.well-known/openid-configuration and extracting the token_endpoint value to use in your token endpoint.

If you haven't changed any endpoints it's kinda redundant still and you can simply do:

 var tokenClient = new TokenClient(
             $"https://your-identity-server/connect/token",
                "clientId",
                "clientSecret");

and then do whatever request you need with that, like:

var result = await tokenClient.RequestClientCredentialsAsync();
  if (!result.IsError)
            {
                return result.AccessToken;
            } else
            {
                throw new Exception($"Error while getting access token! -- {result.Error} -- {result.HttpErrorReason}");
            }