c# - Is there any way to pass custom state or context from the client through identityserver3 to a custom IdP? -
i working on spike following architecture:
[asp.net mvc client] --> [identity server 3 custom middleware] --> [custom idp]
the spike prove out more open, standards-based approach better yet bespoke solution serves 1 purpose.
the functionality flow require such that:
- the client perform user search , retrieve customer id
- the user requested restricted resource providing customer id
- the openid connect pipeline redirects them through custom idp
- the custom idp presents page of secret questions user must answered in order them authenticated
- authentication occurs , passes user through idsvr3 client upon can access restricted resource.
my question - achievable? state encrypted on client , should considered unencryptable. have access source code client, idsvr3 instance, custom middleware , custom idp, magic tricks can think of should achievable.
i'm using latest nuget package openidconnect in mvc client.
i managed by:
- intercepting response within global.asax.cs application_endrequest , appending identifier
- reading identifier in request authorize endpoint in idsvr3
- padding parameter through calls until custom auth middleware called
- appending parameter onto redirect url
Comments
Post a Comment