Early Preview

This is currently very much a preview. Please feel free to try things out, but don't be upset if anything is not yet working. Feedback is welcome over on our GitHub Dicussions page.

interface Duende.​IdentityServer.​Validation.​IResourceOwnerPasswordValidator

Assembly: Duende.IdentityServer

Validates resource owner password credentials submitted to the token endpoint.

Remarks

Implement this interface to support the OAuth 2.0 Resource Owner Password Credentials (ROPC) grant type ( <c>grant_type=password</c> ). IdentityServer invokes <see cref="M:Duende.IdentityServer.Validation.IResourceOwnerPasswordValidator.ValidateAsync(Duende.IdentityServer.Validation.ResourceOwnerPasswordValidationContext,System.Threading.CancellationToken)" /> when a client submits a username and password directly to the token endpoint. <para> The implementation is responsible for authenticating the supplied credentials against the user store (e.g., ASP.NET Core Identity or a custom store) and populating <c>ResourceOwnerPasswordValidationContext.Result</c> with a <c>GrantValidationResult</c> that identifies the authenticated subject. </para> <para> To fail the request, create a <c>GrantValidationResult</c> with an appropriate <c>TokenRequestErrors</c> value (e.g., <c>InvalidGrant</c>) and assign it to <c>context.Result</c>. </para> <para> Register the implementation using <c>AddResourceOwnerValidator&lt;T&gt;()</c> on the IdentityServer builder. </para> <para> Note: The ROPC grant is considered legacy and is <see href="https://docs.duendesoftware.com/identityserver/tokens/extension-grants/ropc">not recommended for new applications</see>. Consider using more secure flows such as the authorization code flow with PKCE. </para>

Methods

ValidateAsync​(ResourceOwnerPasswordValidationContext context, System.​Threading.​CancellationToken ct)
Validates the resource owner password credentials supplied in the token request.
Returns A <see cref="T:System.Threading.Tasks.Task" /> that completes when validation is finished.
context The validation context, providing access to the username, password, and the validated token request. Set <c>context.Result</c> to a <c>GrantValidationResult</c> to indicate success or failure.
ct The cancellation token.