OidcTokenValidator

public sealed class OidcTokenValidator : IDisposable

Checks OpenID Connect ID tokens against the issuers a mesh trusts (NebulaConfig.AuthIssuers): signature (RS256/384/512 and ES256/384/512 with the provider's published keys), issuer, expiry, and audience. Keys come from the issuer's discovery document and JWKS endpoint, fetched on a background thread and cached; a token with an unknown key id triggers one refresh (key rotation). Validate answers at once when the key is cached and otherwise once the fetch lands, always from Tick on the calling thread, so the gateway never blocks on the network.

Constructors

OidcTokenValidator

public OidcTokenValidator(IEnumerable<string> issuers, string audience, Fetcher fetch = null);

Fields

ClockSkew

public TimeSpan ClockSkew = TimeSpan.FromSeconds(60);

Tolerance on exp, nbf and iat.

MinRefreshInterval

public TimeSpan MinRefreshInterval = TimeSpan.FromSeconds(30);

How soon after a fetch an unknown key id may trigger another (a flood of bad tokens must not hammer the provider).

Properties

PendingCount

public int PendingCount { get; }

Tokens waiting for a key fetch.

IssuerCount

public int IssuerCount { get; }

Methods

ParseIssuerList

public static List<string> ParseIssuerList(string spec);

Split a comma- or space-separated issuer list (NebulaConfig.AuthIssuers).

AddKeys

public void AddKeys(string issuer, string jwksJson);

Install a key set by hand (tests, or a provider with no discovery endpoint). Replaces the issuer's cached keys.

Validate

public void Validate(string token, Action<AuthResult> done);

Check token. done runs synchronously when the answer is known now, otherwise from a later Tick once the issuer's keys arrive.

Tick

public void Tick();

Deliver the results of finished key fetches. Call from the thread that calls Validate.

Dispose

public void Dispose();

Nested types

Fetcher

public delegate string Fetcher(string url);

Fetch a URL's body (run on a worker thread). Tests substitute their own.