openiddict-core/src/OpenIddict.Server.Owin/OpenIddictServerOwinConfiguration.cs

/*
 * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
 * See https://github.com/openiddict/openiddict-core for more information concerning
 * the license and the contributors participating to this project.
 */

using System.ComponentModel;
using Microsoft.Extensions.Options;

namespace OpenIddict.Server.Owin;

/// <summary>
/// Contains the methods required to ensure that the OpenIddict server configuration is valid.
/// </summary>
[EditorBrowsable(EditorBrowsableState.Advanced)]
public sealed class OpenIddictServerOwinConfiguration : IConfigureOptions<OpenIddictServerOptions>,
                                                        IPostConfigureOptions<OpenIddictServerOptions>,
                                                        IPostConfigureOptions<OpenIddictServerOwinOptions>
{
    /// <inheritdoc/>
    public void Configure(OpenIddictServerOptions options)
    {
        ArgumentNullException.ThrowIfNull(options);

        // Register the built-in event handlers used by the OpenIddict OWIN server components.
        options.Handlers.AddRange(OpenIddictServerOwinHandlers.DefaultHandlers);

        // Enable client_secret_basic support by default.
        options.ClientAuthenticationMethods.Add(ClientAuthenticationMethods.ClientSecretBasic);
    }

    /// <inheritdoc/>
    public void PostConfigure(string? name, OpenIddictServerOptions options)
    {
        ArgumentNullException.ThrowIfNull(options);

        // Enable tls_client_auth and self_signed_tls_client_auth support if the
        // corresponding chain policies have been configured in the server options.
        if (options.ClientCertificateChainPolicy is not null)
        {
            options.ClientAuthenticationMethods.Add(ClientAuthenticationMethods.TlsClientAuth);
        }

        if (options.SelfSignedClientCertificateChainPolicy is not null)
        {
            options.ClientAuthenticationMethods.Add(ClientAuthenticationMethods.SelfSignedTlsClientAuth);
        }
    }

    /// <inheritdoc/>
    public void PostConfigure(string? name, OpenIddictServerOwinOptions options)
    {
        ArgumentNullException.ThrowIfNull(options);

        if (options.AuthenticationMode is AuthenticationMode.Active)
        {
            throw new InvalidOperationException(SR.GetResourceString(SR.ID0119));
        }
    }
}