155Options = OptionsMonitor.Get(Scheme.Name);

25if (!Options.RequiredConnectionTypes.Any(connectionTypeFeature.ConnectionTypes.Contains)) 27return Task.FromResult(AuthenticateResult.Fail($"Connection types '{string.Join(", ", Options.RequiredConnectionTypes)}' are not enabled on this connection."));

99protected virtual string ClaimsIssuer => Options.ClaimsIssuer ?? Scheme.Name; 157TimeProvider = Options.TimeProvider ?? TimeProvider.System; 171Events = Options.Events; 172if (Options.EventsType != null) 174Events = Context.RequestServices.GetRequiredService(Options.EventsType); 206var target = scheme ?? Options.ForwardDefaultSelector?.Invoke(Context) ?? Options.ForwardDefault; 217var target = ResolveTarget(Options.ForwardAuthenticate); 308var target = ResolveTarget(Options.ForwardChallenge); 323var target = ResolveTarget(Options.ForwardForbid);

28protected string? SignInScheme => Options.SignInScheme; 69=> Task.FromResult(Options.CallbackPath == Request.Path); 116var errorContext = new RemoteFailureContext(Context, Scheme, Options, exception) 146var ticketContext = new TicketReceivedContext(Context, Scheme, Options, ticket) 234var cookieOptions = Options.CorrelationCookie.Build(Context, TimeProvider.GetUtcNow()); 238var cookieName = Options.CorrelationCookie.Name + correlationId; 255Logger.CorrelationPropertyNotFound(Options.CorrelationCookie.Name!); 261var cookieName = Options.CorrelationCookie.Name + correlationId; 270var cookieOptions = Options.CorrelationCookie.Build(Context, TimeProvider.GetUtcNow()); 291var context = new AccessDeniedContext(Context, Scheme, Options) 293AccessDeniedPath = Options.AccessDeniedPath, 296ReturnUrlParameter = Options.ReturnUrlParameter

40var target = ResolveTarget(Options.ForwardSignIn);

39var target = ResolveTarget(Options.ForwardSignOut);

27var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options); 43var ticket = Options.BearerTokenProtector.Unprotect(token); 69properties.ExpiresUtc = utcNow + Options.BearerTokenExpiration; 73AccessToken = Options.BearerTokenProtector.Protect(CreateBearerTicket(user, properties)), 74ExpiresIn = (long)Options.BearerTokenExpiration.TotalSeconds, 75RefreshToken = Options.RefreshTokenProtector.Protect(CreateRefreshTicket(user, utcNow)), 110ExpiresUtc = utcNow + Options.RefreshTokenExpiration

109var authenticationFailedContext = new CertificateAuthenticationFailedContext(Context, Scheme, Options) 125!Options.AllowedCertificateTypes.HasFlag(CertificateTypes.SelfSigned)) 134!Options.AllowedCertificateTypes.HasFlag(CertificateTypes.Chained)) 172var certificateValidatedContext = new CertificateValidatedContext(Context, Scheme, Options) 191var authenticationChallengedContext = new CertificateChallengeContext(Context, Scheme, Options, properties); 207X509RevocationFlag revocationFlag = Options.RevocationFlag; 208X509RevocationMode revocationMode = Options.RevocationMode; 223if (Options.ValidateCertificateUse) 236if (Options.CustomTrustStore != null) 238chainPolicy.CustomTrustStore.AddRange(Options.CustomTrustStore); 241chainPolicy.TrustMode = Options.ChainTrustValidationMode; 244chainPolicy.ExtraStore.AddRange(Options.AdditionalChainCertificates); 246if (!Options.ValidateValidityPeriod) 259claims.Add(new Claim("issuer", issuer, ClaimValueTypes.String, Options.ClaimsIssuer)); 262claims.Add(new Claim(ClaimTypes.Thumbprint, thumbprint, ClaimValueTypes.Base64Binary, Options.ClaimsIssuer)); 267claims.Add(new Claim(ClaimTypes.X500DistinguishedName, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 273claims.Add(new Claim(ClaimTypes.SerialNumber, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 279claims.Add(new Claim(ClaimTypes.Dns, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 285claims.Add(new Claim(ClaimTypes.Name, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 291claims.Add(new Claim(ClaimTypes.Email, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 297claims.Add(new Claim(ClaimTypes.Upn, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 303claims.Add(new Claim(ClaimTypes.Uri, value, ClaimValueTypes.String, Options.ClaimsIssuer));

99if (issuedUtc != null && expiresUtc != null && Options.SlidingExpiration && allowRefresh) 104var eventContext = new CookieSlidingExpirationContext(Context, Scheme, Options, ticket, timeElapsed, timeRemaining) 153var cookie = Options.CookieManager.GetRequestCookie(Context, Options.Cookie.Name!); 159var ticket = Options.TicketDataFormat.Unprotect(cookie, GetTlsTokenBinding()); 165if (Options.SessionStore != null) 173ticket = await Options.SessionStore.RetrieveAsync(claim.Value, Context, Context.RequestAborted); 186if (Options.SessionStore != null) 188await Options.SessionStore.RemoveAsync(_sessionKey!, Context, Context.RequestAborted); 214var context = new CookieValidatePrincipalContext(Context, Scheme, Options, result.Ticket); 232var cookieOptions = Options.Cookie.Build(Context); 263if (Options.SessionStore != null && _sessionKey != null) 265await Options.SessionStore.RenewAsync(_sessionKey, ticket, Context, Context.RequestAborted); 268new[] { new Claim(SessionIdClaim, _sessionKey, ClaimValueTypes.String, Options.ClaimsIssuer) }, 273var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding()); 281Options.CookieManager.AppendResponseCookie( 283Options.Cookie.Name!, 307Options, 325signInContext.Properties.ExpiresUtc = issuedUtc.Add(Options.ExpireTimeSpan); 332var expiresUtc = signInContext.Properties.ExpiresUtc ?? issuedUtc.Add(Options.ExpireTimeSpan); 338if (Options.SessionStore != null) 343await Options.SessionStore.RenewAsync(_sessionKey, ticket, Context, Context.RequestAborted); 347_sessionKey = await Options.SessionStore.StoreAsync(ticket, Context, Context.RequestAborted); 352new[] { new Claim(SessionIdClaim, _sessionKey, ClaimValueTypes.String, Options.ClaimsIssuer) }, 353Options.ClaimsIssuer)); 357var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding()); 359Options.CookieManager.AppendResponseCookie( 361Options.Cookie.Name!, 370Options); 375var shouldHonorReturnUrlParameter = Options.LoginPath.HasValue && OriginalPath == Options.LoginPath; 391if (Options.SessionStore != null && _sessionKey != null) 393await Options.SessionStore.RemoveAsync(_sessionKey, Context, Context.RequestAborted); 399Options, 405Options.CookieManager.DeleteCookie( 407Options.Cookie.Name!, 411var shouldHonorReturnUrlParameter = Options.LogoutPath.HasValue && OriginalPath == Options.LogoutPath; 434redirectUri = Request.Query[Options.ReturnUrlParameter]; 444new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, redirectUri)); 462var accessDeniedUri = Options.AccessDeniedPath + QueryString.Create(Options.ReturnUrlParameter, returnUrl); 463var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(accessDeniedUri)); 476var loginUri = Options.LoginPath + QueryString.Create(Options.ReturnUrlParameter, redirectUri); 477var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(loginUri));

42var endpoint = QueryHelpers.AddQueryString(Options.UserInformationEndpoint, "access_token", tokens.AccessToken!); 43if (Options.SendAppSecretProof) 47if (Options.Fields.Count > 0) 49endpoint = QueryHelpers.AddQueryString(endpoint, "fields", string.Join(",", Options.Fields)); 60var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement); 69var key = Encoding.ASCII.GetBytes(Options.AppSecret);

47var request = new HttpRequestMessage(HttpMethod.Get, Options.UserInformationEndpoint); 58var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement); 74SetQueryParam(queryStrings, properties, GoogleChallengeProperties.ScopeKey, FormatScope, Options.Scope); 75SetQueryParam(queryStrings, properties, GoogleChallengeProperties.AccessTypeKey, Options.AccessType); 82queryStrings["state"] = Options.StateDataFormat.Protect(properties); 84return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, queryStrings);

62var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options); 101if (!Options.UseSecurityTokenValidators) 103foreach (var tokenHandler in Options.TokenHandlers) 130foreach (var validator in Options.SecurityTokenValidators) 153var tokenValidatedContext = new TokenValidatedContext(Context, Scheme, Options) 168if (Options.SaveToken) 182var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options) 196if (!Options.UseSecurityTokenValidators) 207var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options) 232if (Options.RefreshOnIssuerKeyNotFound && Options.ConfigurationManager != null 235Options.ConfigurationManager.RequestRefresh(); 242var tokenValidationParameters = Options.TokenValidationParameters.Clone(); 244if (Options.ConfigurationManager is BaseConfigurationManager baseConfigurationManager) 250if (Options.ConfigurationManager != null) 253var configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 278var eventContext = new JwtBearerChallengeContext(Context, Scheme, Options, properties) 284if (Options.IncludeErrorDetails && eventContext.AuthenticateFailure != null) 302Response.Headers.Append(HeaderNames.WWWAuthenticate, Options.Challenge); 308var builder = new StringBuilder(Options.Challenge); 309if (Options.Challenge.IndexOf(' ') > 0) 351var forbiddenContext = new ForbiddenContext(Context, Scheme, Options);

43var request = new HttpRequestMessage(HttpMethod.Get, Options.UserInformationEndpoint); 54var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement); 66{ "client_id", Options.ClientId }, 71AddQueryString(queryStrings, properties, MicrosoftChallengeProperties.ScopeKey, FormatScope, Options.Scope); 79if (Options.UsePkce) 95var state = Options.StateDataFormat.Protect(properties); 98return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, queryStrings!);

75if (_requestProcessed || Options.DeferToServer) 132_negotiateState ??= Options.StateFactory.CreateInstance(); 202if (_negotiateState.Protocol == "NTLM" && !Options.PersistNtlmCredentials) 215if (Options.PersistKerberosCredentials) 266var errorContext = new AuthenticationFailedContext(Context, Scheme, Options) { Exception = ex }; 335if (Options.LdapSettings.EnableLdapClaimResolution) 337var ldapContext = new LdapContext(Context, Scheme, Options, Options.LdapSettings) 351authenticatedContext = new AuthenticatedContext(Context, Scheme, Options) 358authenticatedContext = new AuthenticatedContext(Context, Scheme, Options) 384var eventContext = new ChallengeContext(Context, Scheme, Options, properties);

28protected HttpClient Backchannel => Options.Backchannel; 69var properties = Options.StateDataFormat.Unprotect(state); 133var codeExchangeContext = new OAuthCodeExchangeContext(properties, code.ToString(), BuildRedirectUri(Options.CallbackPath)); 148if (Options.SaveTokens) 202{ "client_id", Options.ClientId }, 204{ "client_secret", Options.ClientSecret }, 218var requestMessage = new HttpRequestMessage(HttpMethod.Post, Options.TokenEndpoint); 256var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, user.RootElement); 273var authorizationEndpoint = BuildChallengeUrl(properties, BuildRedirectUri(Options.CallbackPath)); 275Context, Scheme, Options, 307{ "client_id", Options.ClientId }, 313if (Options.UsePkce) 329parameters["state"] = Options.StateDataFormat.Protect(properties); 331foreach (var additionalParameter in Options.AdditionalAuthorizationParameters) 336return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, parameters!); 353=> FormatScope(Options.Scope);

40protected HttpClient Backchannel => Options.Backchannel; 91if (Options.RemoteSignOutPath.HasValue && Options.RemoteSignOutPath == Request.Path) 95else if (Options.SignedOutCallbackPath.HasValue && Options.SignedOutCallbackPath == Request.Path) 136var remoteSignOutContext = new RemoteSignOutContext(Context, Scheme, Options, message); 166var principal = (await Context.AuthenticateAsync(Options.SignOutScheme))?.Principal; 205await Context.SignOutAsync(Options.SignOutScheme); 215var target = ResolveTarget(Options.ForwardSignOut); 226if (_configuration == null && Options.ConfigurationManager != null) 228_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 233EnableTelemetryParameters = !Options.DisableTelemetry, 237PostLogoutRedirectUri = BuildRedirectUriIfRelative(Options.SignedOutCallbackPath) 243properties.RedirectUri = BuildRedirectUriIfRelative(Options.SignedOutRedirectUri); 252message.IdTokenHint = await Context.GetTokenAsync(Options.SignOutScheme, OpenIdConnectParameterNames.IdToken); 254var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 273message.State = Options.StateDataFormat.Protect(properties); 280if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.RedirectGet) 290else if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.FormPost) 307throw new NotImplementedException($"An unsupported authentication method has been configured: {Options.AuthenticationMethod}"); 327properties = Options.StateDataFormat.Unprotect(message.State); 330var signOut = new RemoteSignOutContext(Context, Scheme, Options, message) 398if (_configuration == null && Options.ConfigurationManager != null) 400_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 405ClientId = Options.ClientId, 406EnableTelemetryParameters = !Options.DisableTelemetry, 408RedirectUri = BuildRedirectUri(Options.CallbackPath), 409Resource = Options.Resource, 410ResponseType = Options.ResponseType, 411Prompt = properties.GetParameter<string>(OpenIdConnectParameterNames.Prompt) ?? Options.Prompt, 412Scope = string.Join(" ", properties.GetParameter<ICollection<string>>(OpenIdConnectParameterNames.Scope) ?? Options.Scope), 416if (Options.UsePkce && Options.ResponseType == OpenIdConnectResponseType.Code) 434var maxAge = properties.GetParameter<TimeSpan?>(OpenIdConnectParameterNames.MaxAge) ?? Options.MaxAge; 444if (!string.Equals(Options.ResponseType, OpenIdConnectResponseType.Code, StringComparison.Ordinal) || 445!string.Equals(Options.ResponseMode, OpenIdConnectResponseMode.Query, StringComparison.Ordinal)) 447message.ResponseMode = Options.ResponseMode; 450if (Options.ProtocolValidator.RequireNonce) 452message.Nonce = Options.ProtocolValidator.GenerateNonce(); 458foreach (var additionalParameter in Options.AdditionalAuthorizationParameters) 463var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 485message.State = Options.StateDataFormat.Protect(properties); 495switch (Options.PushedAuthorizationBehavior) 526if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.RedirectGet) 537else if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.FormPost) 554throw new NotImplementedException($"An unsupported authentication method has been configured: {Options.AuthenticationMethod}"); 563var context = new PushedAuthorizationContext(Context, Scheme, Options, parRequest, properties); 574if (!string.IsNullOrEmpty(Options.ClientSecret)) 576parRequest.Parameters.Add(OpenIdConnectParameterNames.ClientSecret, Options.ClientSecret); 605authorizeRequest.Parameters.Add("client_id", Options.ClientId); 652if (Options.SkipUnrecognizedRequests) 677if (Options.SkipUnrecognizedRequests) 705if (Options.SkipUnrecognizedRequests) 718if (Options.SkipUnrecognizedRequests) 753if (_configuration == null && Options.ConfigurationManager != null) 756_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 764var validationParameters = Options.TokenValidationParameters.Clone(); 771if (!Options.UseSecurityTokenValidator) 800Options.ProtocolValidator.ValidateAuthenticationResponse(new OpenIdConnectProtocolValidationContext() 802ClientId = Options.ClientId, 852if (!Options.UseSecurityTokenValidator) 897Options.ProtocolValidator.ValidateTokenResponse(new OpenIdConnectProtocolValidationContext() 899ClientId = Options.ClientId, 907if (Options.SaveTokens) 912if (Options.GetClaimsFromUserInfoEndpoint) 921foreach (var action in Options.ClaimActions) 935if (Options.RefreshOnIssuerKeyNotFound && exception is SecurityTokenSignatureKeyNotFoundException) 937if (Options.ConfigurationManager != null) 940Options.ConfigurationManager.RequestRefresh(); 959properties = Options.StateDataFormat.Unprotect(message.State); 1093Options.ProtocolValidator.ValidateUserInfoResponse(new OpenIdConnectProtocolValidationContext() 1101foreach (var action in Options.ClaimActions) 1164var cookieOptions = Options.NonceCookie.Build(Context, TimeProvider.GetUtcNow()); 1168Options.NonceCookie.Name + Options.StringDataFormat.Protect(nonce), 1189if (Options.NonceCookie.Name is string name && nonceKey.StartsWith(name, StringComparison.Ordinal)) 1193var nonceDecodedValue = Options.StringDataFormat.Unprotect(nonceKey.Substring(Options.NonceCookie.Name.Length, nonceKey.Length - Options.NonceCookie.Name.Length)); 1196var cookieOptions = Options.NonceCookie.Build(Context, TimeProvider.GetUtcNow()); 1214var context = new MessageReceivedContext(Context, Scheme, Options, properties) 1237var context = new TokenValidatedContext(Context, Scheme, Options, user, properties) 1267ClientId = Options.ClientId, 1268ClientSecret = Options.ClientSecret, 1271EnableTelemetryParameters = !Options.DisableTelemetry, 1282var context = new AuthorizationCodeReceivedContext(Context, Scheme, Options, properties) 1314var context = new TokenResponseReceivedContext(Context, Scheme, Options, user, properties) 1340var context = new UserInformationReceivedContext(Context, Scheme, Options, principal, properties) 1364var context = new AuthenticationFailedContext(Context, Scheme, Options) 1390if (!Options.SecurityTokenValidator.CanReadToken(idToken)) 1407var principal = Options.SecurityTokenValidator.ValidateToken(idToken, validationParameters, out SecurityToken validatedToken); 1425if (Options.UseTokenLifetime) 1446if (Options.ConfigurationManager is BaseConfigurationManager baseConfigurationManager) 1459var validationResult = await Options.TokenHandler.ValidateTokenAsync(idToken, validationParameters); 1480if (Options.UseTokenLifetime)

25private HttpClient Backchannel => Options.Backchannel; 61var protectedRequestToken = Request.Cookies[Options.StateCookie.Name!]; 63var requestToken = Options.StateDataFormat.Unprotect(protectedRequestToken); 101var cookieOptions = Options.StateCookie.Build(Context, TimeProvider.GetUtcNow()); 103Response.Cookies.Delete(Options.StateCookie.Name!, cookieOptions); 117if (Options.RetrieveUserDetails) 128if (Options.SaveTokens) 152foreach (var action in Options.ClaimActions) 157var context = new TwitterCreatingTicketContext(Context, Scheme, Options, new ClaimsPrincipal(identity), properties, token.UserId, token.ScreenName, token.Token, token.TokenSecret, user); 172var requestToken = await ObtainRequestTokenAsync(BuildRedirectUri(Options.CallbackPath), properties); 175var cookieOptions = Options.StateCookie.Build(Context, TimeProvider.GetUtcNow()); 178Response.Cookies.Append(Options.StateCookie.Name!, Options.StateDataFormat.Protect(requestToken), cookieOptions); 180var redirectContext = new RedirectContext<TwitterOptions>(Context, Scheme, Options, properties, twitterAuthenticationEndpoint); 188{ "oauth_consumer_key", Options.ConsumerKey! }, 231var signature = ComputeSignature(Options.ConsumerSecret!, accessToken?.TokenSecret, stringBuilder.ToString());

70if (Options.RemoteSignOutPath.HasValue && Options.RemoteSignOutPath == Request.Path && HttpMethods.IsGet(Request.Method) 89_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 101Wtrealm = Options.Wtrealm, 105if (!string.IsNullOrEmpty(Options.Wreply)) 107wsFederationMessage.Wreply = Options.Wreply; 111wsFederationMessage.Wreply = BuildRedirectUri(Options.CallbackPath); 116var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 134wsFederationMessage.Wctx = Uri.EscapeDataString(Options.StateDataFormat.Protect(properties)); 170if (Options.SkipUnrecognizedRequests) 185properties = Options.StateDataFormat.Unprotect(state); 189if (!Options.AllowUnsolicitedLogins) 201var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options, properties) 233var securityTokenReceivedContext = new SecurityTokenReceivedContext(Context, Scheme, Options, properties) 248if (!Options.UseSecurityTokenHandlers) 250foreach (var tokenHandler in Options.TokenHandlers) 281foreach (var validator in Options.SecurityTokenHandlers) 317if (Options.UseTokenLifetime && validatedToken != null) 333var securityTokenValidatedContext = new SecurityTokenValidatedContext(Context, Scheme, Options, principal, properties) 356var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options) 375var tokenValidationParameters = Options.TokenValidationParameters.Clone(); 377if (Options.ConfigurationManager is BaseConfigurationManager baseConfigurationManager) 383if (Options.ConfigurationManager != null) 386_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 401if (Options.RefreshOnIssuerKeyNotFound && exception is SecurityTokenSignatureKeyNotFoundException) 403Options.ConfigurationManager.RequestRefresh(); 413var target = ResolveTarget(Options.ForwardSignOut); 422_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 428Wtrealm = Options.Wtrealm, 440else if (!string.IsNullOrEmpty(Options.SignOutWreply)) 442wsFederationMessage.Wreply = BuildRedirectUriIfRelative(Options.SignOutWreply); 444else if (!string.IsNullOrEmpty(Options.Wreply)) 446wsFederationMessage.Wreply = BuildRedirectUriIfRelative(Options.Wreply); 449var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 477var remoteSignOutContext = new RemoteSignOutContext(Context, Scheme, Options, message); 496await Context.SignOutAsync(Options.SignOutScheme);