Class OAuthIdentity
- Namespace
- MailFathom.Infrastructure.Security.OAuth
- Assembly
- MailFathom.Infrastructure.dll
The identity MailFathom keeps from a validated access token, and what it is allowed to be asked.
public static class OAuthIdentity- Inheritance
-
OAuthIdentity
- Inherited Members
Remarks
A validated token routinely carries a name, an email address, a set of groups, a tenant, and whatever else the authorization server was configured to include. None of it is copied here. What survives validation is who the token is for, who said so, and which scopes it carries — because those are the only three facts anything downstream acts on, and a claim that is present is a claim something will eventually be tempted to trust.
The identity is iss together with sub, never sub alone. A subject identifier is only unique
within the server that issued it, so two authorization servers can both name a subject 1 without either being
wrong; pairing it with the issuer is what stops a deployment trusting two servers from merging their populations. It
is also deliberately not an email address: an address is reassignable and a mailbox belongs to whoever holds it
today, whereas sub is what the server promises will not be reused.
Scopes are read from both spellings in circulation. RFC 9068 defines scope as a space-delimited string, and
several servers emit scp instead, sometimes repeated rather than delimited. Reading both is not a
provider-specific branch: nothing here asks which server sent the token, and a server emitting neither simply carries
no scopes.
Fields
- IssuerClaimType
The claim type carrying the issuer that authenticated the person, which is half of their identity.
- RoleClaimType
The claim type a role check reads on an identity this produces, which nothing ever issues.
- ScopeClaimType
The claim type carrying one scope the validated token granted.
- SubjectClaimType
The claim type carrying the stable identity of the person a request was authorized by.
Methods
- CarriesEveryScope(ClaimsPrincipal, IReadOnlyCollection<string>)
Reports whether an authenticated principal carries every scope a request requires.
- FromValidatedToken(IEnumerable<Claim>, string)
Maps a validated token's claims onto the minimal identity MailFathom carries.
- IdentityCarriedBy(ClaimsPrincipal)
Reports which person a principal is, when a validated token produced it.
- IdentityOf(string, string)
Joins an issuer and a subject into the one identity everything else compares against.