diff --git a/IdentityServer/v6/BFF/DPoP/.vscode/launch.json b/IdentityServer/v6/BFF/DPoP/.vscode/launch.json
new file mode 100644
index 00000000..71e82bc5
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/.vscode/launch.json
@@ -0,0 +1,46 @@
+{
+ "version": "0.2.0",
+ "compounds": [
+ {
+ "name": "Run All",
+ "configurations": ["BFF", "API"],
+ "presentation": {
+ "hidden": false,
+ "group": "",
+ "order": 1
+ }
+ }
+ ],
+ "configurations": [
+ {
+ "name": "API",
+ "type": "coreclr",
+ "request": "launch",
+ "preLaunchTask": "build-api",
+ "program": "${workspaceFolder}/DPoP.Api/bin/Debug/net6.0/DPoP.Api.dll",
+ "args": [],
+ "cwd": "${workspaceFolder}/DPoP.Api",
+ "env": {
+ "ASPNETCORE_ENVIRONMENT": "Development"
+ },
+ "console": "externalTerminal",
+ },
+ {
+ "name": "BFF",
+ "type": "coreclr",
+ "request": "launch",
+ "preLaunchTask": "build-bff",
+ "program": "${workspaceFolder}/DPoP.Bff/bin/Debug/net6.0/DPoP.Bff.dll",
+ "args": [],
+ "cwd": "${workspaceFolder}/DPoP.Bff",
+ "env": {
+ "ASPNETCORE_ENVIRONMENT": "Development"
+ },
+ "serverReadyAction": {
+ "action": "openExternally",
+ "pattern": "\\bNow listening on:\\s+(https?://\\S+)"
+ },
+ "console": "externalTerminal",
+ }
+ ]
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/.vscode/tasks.json b/IdentityServer/v6/BFF/DPoP/.vscode/tasks.json
new file mode 100644
index 00000000..0a883487
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/.vscode/tasks.json
@@ -0,0 +1,43 @@
+{
+ "version": "2.0.0",
+ "tasks": [
+ {
+ "label": "build",
+ "type": "process",
+ "command": "dotnet",
+ "args": [
+ "build",
+ "${workspaceFolder}/DPoP.sln",
+ "/property:GenerateFullPaths=true",
+ "/consoleloggerparameters:NoSummary"
+ ],
+ "problemMatcher": "$msCompile"
+ },
+ {
+ "label": "build-api",
+ "type": "process",
+ "command": "dotnet",
+ "args": [
+ "build",
+ "${workspaceFolder}\\DPoP.Api\\DPoP.Api.csproj",
+ "/property:GenerateFullPaths=true",
+ "/consoleloggerparameters:NoSummary"
+ ],
+ "problemMatcher": "$msCompile"
+ },
+ {
+ "label": "build-bff",
+ "type": "process",
+ "command": "dotnet",
+ "args": [
+ "build",
+ "${workspaceFolder}\\DPoP.Bff\\DPoP.Bff.csproj",
+
+ "/property:GenerateFullPaths=true",
+ "/consoleloggerparameters:NoSummary"
+ ],
+ "problemMatcher": "$msCompile"
+ }
+ ]
+
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP.Api.csproj b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP.Api.csproj
new file mode 100644
index 00000000..32a23fe2
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP.Api.csproj
@@ -0,0 +1,12 @@
+
+
+
+ net6.0
+
+
+
+
+
+
+
+
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/ConfigureJwtBearerOptions.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/ConfigureJwtBearerOptions.cs
new file mode 100644
index 00000000..b75028c4
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/ConfigureJwtBearerOptions.cs
@@ -0,0 +1,35 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.Options;
+using System;
+
+namespace DPoP.Api;
+
+public class ConfigureJwtBearerOptions : IPostConfigureOptions
+{
+ private readonly string _configScheme;
+
+ public ConfigureJwtBearerOptions(string configScheme)
+ {
+ _configScheme = configScheme;
+ }
+
+ public void PostConfigure(string name, JwtBearerOptions options)
+ {
+ if (_configScheme == name)
+ {
+ if (options.EventsType != null && !typeof(DPoPJwtBearerEvents).IsAssignableFrom(options.EventsType))
+ {
+ throw new Exception("EventsType on JwtBearerOptions must derive from DPoPJwtBearerEvents to work with the DPoP support.");
+ }
+ if (options.Events != null && !typeof(DPoPJwtBearerEvents).IsAssignableFrom(options.Events.GetType()))
+ {
+ throw new Exception("Events on JwtBearerOptions must derive from DPoPJwtBearerEvents to work with the DPoP support.");
+ }
+
+ if (options.Events == null && options.EventsType == null)
+ {
+ options.EventsType = typeof(DPoPJwtBearerEvents);
+ }
+ }
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPExtensions.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPExtensions.cs
new file mode 100644
index 00000000..8cafdcb9
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPExtensions.cs
@@ -0,0 +1,81 @@
+using IdentityModel;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.IdentityModel.Tokens;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+
+namespace DPoP.Api;
+
+///
+/// Extensions methods for DPoP
+///
+static class DPoPExtensions
+{
+ const string DPoPPrefix = OidcConstants.AuthenticationSchemes.AuthorizationHeaderDPoP + " ";
+
+ public static bool IsDPoPAuthorizationScheme(this HttpRequest request)
+ {
+ var authz = request.Headers.Authorization.FirstOrDefault();
+ return authz?.StartsWith(DPoPPrefix, System.StringComparison.Ordinal) == true;
+ }
+
+ public static bool TryGetDPoPAccessToken(this HttpRequest request, out string token)
+ {
+ token = null;
+
+ var authz = request.Headers.Authorization.FirstOrDefault();
+ if (authz?.StartsWith(DPoPPrefix, System.StringComparison.Ordinal) == true)
+ {
+ token = authz[DPoPPrefix.Length..].Trim();
+ return true;
+ }
+ return false;
+ }
+
+ public static string GetAuthorizationScheme(this HttpRequest request)
+ {
+ return request.Headers.Authorization.FirstOrDefault()?.Split(' ', System.StringSplitOptions.RemoveEmptyEntries)[0];
+ }
+
+ public static string GetDPoPProofToken(this HttpRequest request)
+ {
+ return request.Headers[OidcConstants.HttpHeaders.DPoP].FirstOrDefault();
+ }
+
+ public static string GetDPoPNonce(this AuthenticationProperties props)
+ {
+ if (props.Items.ContainsKey("DPoP-Nonce"))
+ {
+ return props.Items["DPoP-Nonce"] as string;
+ }
+ return null;
+ }
+ public static void SetDPoPNonce(this AuthenticationProperties props, string nonce)
+ {
+ props.Items["DPoP-Nonce"] = nonce;
+ }
+
+ ///
+ /// Create the value of a thumbprint-based cnf claim
+ ///
+ public static string CreateThumbprintCnf(this JsonWebKey jwk)
+ {
+ var jkt = jwk.CreateThumbprint();
+ var values = new Dictionary
+ {
+ { JwtClaimTypes.ConfirmationMethods.JwkThumbprint, jkt }
+ };
+ return JsonSerializer.Serialize(values);
+ }
+
+ ///
+ /// Create the value of a thumbprint
+ ///
+ public static string CreateThumbprint(this JsonWebKey jwk)
+ {
+ var jkt = Base64Url.Encode(jwk.ComputeJwkThumbprint());
+ return jkt;
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPJwtBearerEvents.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPJwtBearerEvents.cs
new file mode 100644
index 00000000..2b71a68b
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPJwtBearerEvents.cs
@@ -0,0 +1,152 @@
+using IdentityModel;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.Options;
+using Microsoft.Net.Http.Headers;
+using System.Text;
+using System.Threading.Tasks;
+using static IdentityModel.OidcConstants;
+
+namespace DPoP.Api;
+
+public class DPoPJwtBearerEvents : JwtBearerEvents
+{
+ private readonly IOptionsMonitor _optionsMonitor;
+ private readonly DPoPProofValidator _validator;
+
+ public DPoPJwtBearerEvents(IOptionsMonitor optionsMonitor, DPoPProofValidator validator)
+ {
+ _optionsMonitor = optionsMonitor;
+ _validator = validator;
+ }
+
+ public override Task MessageReceived(MessageReceivedContext context)
+ {
+ var dpopOptions = _optionsMonitor.Get(context.Scheme.Name);
+
+ if (context.HttpContext.Request.TryGetDPoPAccessToken(out var token))
+ {
+ context.Token = token;
+ }
+ else if (dpopOptions.Mode == DPoPMode.DPoPOnly)
+ {
+ // this rejects the attempt for this handler,
+ // since we don't want to attempt Bearer given the Mode
+ context.NoResult();
+ }
+
+ return Task.CompletedTask;
+ }
+
+ public override async Task TokenValidated(TokenValidatedContext context)
+ {
+ var dpopOptions = _optionsMonitor.Get(context.Scheme.Name);
+
+ if (context.HttpContext.Request.TryGetDPoPAccessToken(out var at))
+ {
+ var proofToken = context.HttpContext.Request.GetDPoPProofToken();
+ var result = await _validator.ValidateAsync(new DPoPProofValidatonContext
+ {
+ Scheme = context.Scheme.Name,
+ ProofToken = proofToken,
+ AccessToken = at,
+ Method = context.HttpContext.Request.Method,
+ Url = context.HttpContext.Request.Scheme + "://" + context.HttpContext.Request.Host + context.HttpContext.Request.PathBase + context.HttpContext.Request.Path
+ });
+
+ if (result.IsError)
+ {
+ // fails the result
+ context.Fail(result.ErrorDescription ?? result.Error);
+
+ // we need to stash these values away so they are available later when the Challenge method is called later
+ context.HttpContext.Items["DPoP-Error"] = result.Error;
+ if (!string.IsNullOrWhiteSpace(result.ErrorDescription))
+ {
+ context.HttpContext.Items["DPoP-ErrorDescription"] = result.ErrorDescription;
+ }
+ if (!string.IsNullOrWhiteSpace(result.ServerIssuedNonce))
+ {
+ context.HttpContext.Items["DPoP-Nonce"] = result.ServerIssuedNonce;
+ }
+ }
+ }
+ else if (dpopOptions.Mode == DPoPMode.DPoPAndBearer)
+ {
+ // if the scheme used was not DPoP, then it was Bearer
+ // and if a access token was presented with a cnf, then the
+ // client should have sent it as DPoP, so we fail the request
+ if (context.Principal.HasClaim(x => x.Type == JwtClaimTypes.Confirmation))
+ {
+ context.HttpContext.Items["Bearer-ErrorDescription"] = "Must use DPoP when using an access token with a 'cnf' claim";
+ context.Fail("Must use DPoP when using an access token with a 'cnf' claim");
+ }
+ }
+ }
+
+ public override Task Challenge(JwtBearerChallengeContext context)
+ {
+ var dpopOptions = _optionsMonitor.Get(context.Scheme.Name);
+
+ if (dpopOptions.Mode == DPoPMode.DPoPOnly)
+ {
+ // if we are using DPoP only, then we don't need/want the default
+ // JwtBearerHandler to add its WWW-Authenticate response header
+ // so we have to set the status code ourselves
+ context.Response.StatusCode = 401;
+ context.HandleResponse();
+ }
+ else if (context.HttpContext.Items.ContainsKey("Bearer-ErrorDescription"))
+ {
+ var description = context.HttpContext.Items["Bearer-ErrorDescription"] as string;
+ context.ErrorDescription = description;
+ }
+
+ if (context.HttpContext.Request.IsDPoPAuthorizationScheme())
+ {
+ // if we are challening due to dpop, then don't allow bearer www-auth to emit an error
+ context.Error = null;
+ }
+
+ // now we always want to add our WWW-Authenticate for DPoP
+ // For example:
+ // WWW-Authenticate: DPoP error="invalid_dpop_proof", error_description="Invalid 'iat' value."
+ var sb = new StringBuilder();
+ sb.Append(OidcConstants.AuthenticationSchemes.AuthorizationHeaderDPoP);
+
+ if (context.HttpContext.Items.ContainsKey("DPoP-Error"))
+ {
+ var error = context.HttpContext.Items["DPoP-Error"] as string;
+ sb.Append(" error=\"");
+ sb.Append(error);
+ sb.Append('\"');
+
+ if (context.HttpContext.Items.ContainsKey("DPoP-ErrorDescription"))
+ {
+ var description = context.HttpContext.Items["DPoP-ErrorDescription"] as string;
+
+ sb.Append(", error_description=\"");
+ sb.Append(description);
+ sb.Append('\"');
+ }
+ }
+
+ context.Response.Headers.Add(HeaderNames.WWWAuthenticate, sb.ToString());
+
+
+ if (context.HttpContext.Items.ContainsKey("DPoP-Nonce"))
+ {
+ var nonce = context.HttpContext.Items["DPoP-Nonce"] as string;
+ context.Response.Headers[HttpHeaders.DPoPNonce] = nonce;
+ }
+ else
+ {
+ var nonce = context.Properties.GetDPoPNonce();
+ if (nonce != null)
+ {
+ context.Response.Headers[HttpHeaders.DPoPNonce] = nonce;
+ }
+ }
+
+ return Task.CompletedTask;
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPMode.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPMode.cs
new file mode 100644
index 00000000..209429d8
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPMode.cs
@@ -0,0 +1,13 @@
+namespace DPoP.Api;
+
+public enum DPoPMode
+{
+ ///
+ /// Only DPoP tokens will be accepted
+ ///
+ DPoPOnly,
+ ///
+ /// Both DPoP and Bearer tokens will be accepted
+ ///
+ DPoPAndBearer
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPOptions.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPOptions.cs
new file mode 100644
index 00000000..5e0f5ca1
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPOptions.cs
@@ -0,0 +1,15 @@
+using System;
+
+namespace DPoP.Api;
+
+public class DPoPOptions
+{
+ public DPoPMode Mode { get; set; } = DPoPMode.DPoPOnly;
+
+ public TimeSpan ProofTokenValidityDuration { get; set; } = TimeSpan.FromSeconds(1);
+ public TimeSpan ClientClockSkew { get; set; } = TimeSpan.FromMinutes(0);
+ public TimeSpan ServerClockSkew { get; set; } = TimeSpan.FromMinutes(5);
+
+ public bool ValidateIat { get; set; } = true;
+ public bool ValidateNonce { get; set; } = false;
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidatonContext.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidatonContext.cs
new file mode 100644
index 00000000..f7f86d4d
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidatonContext.cs
@@ -0,0 +1,32 @@
+using System.Collections.Generic;
+using System.Security.Claims;
+
+namespace DPoP.Api;
+
+public class DPoPProofValidatonContext
+{
+ ///
+ /// The ASP.NET Core authentication scheme triggering the validation
+ ///
+ public string Scheme { get; set; }
+
+ ///
+ /// The HTTP URL to validate
+ ///
+ public string Url { get; set; }
+
+ ///
+ /// The HTTP method to validate
+ ///
+ public string Method { get; set; }
+
+ ///
+ /// The DPoP proof token to validate
+ ///
+ public string ProofToken { get; set; }
+
+ ///
+ /// The access token
+ ///
+ public string AccessToken { get; set; }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidatonResult.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidatonResult.cs
new file mode 100644
index 00000000..88c67934
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidatonResult.cs
@@ -0,0 +1,68 @@
+using System.Collections.Generic;
+
+namespace DPoP.Api;
+
+public class DPoPProofValidatonResult
+{
+ public static DPoPProofValidatonResult Success = new DPoPProofValidatonResult { IsError = false };
+
+ ///
+ /// Indicates if the result was successful or not
+ ///
+ public bool IsError { get; set; }
+
+ ///
+ /// The error code for the validation result
+ ///
+ public string Error { get; set; }
+
+ ///
+ /// The error description code for the validation result
+ ///
+ public string ErrorDescription { get; set; }
+
+ ///
+ /// The serialized JWK from the validated DPoP proof token.
+ ///
+ public string JsonWebKey { get; set; }
+
+ ///
+ /// The JWK thumbprint from the validated DPoP proof token.
+ ///
+ public string JsonWebKeyThumbprint { get; set; }
+
+ ///
+ /// The cnf value for the DPoP proof token
+ ///
+ public string Confirmation { get; set; }
+
+ ///
+ /// The payload value of the DPoP proof token.
+ ///
+ public IDictionary Payload { get; internal set; }
+
+ ///
+ /// The jti value read from the payload.
+ ///
+ public string TokenId { get; set; }
+
+ ///
+ /// The ath value read from the payload.
+ ///
+ public string AccessTokenHash { get; set; }
+
+ ///
+ /// The nonce value read from the payload.
+ ///
+ public string Nonce { get; set; }
+
+ ///
+ /// The iat value read from the payload.
+ ///
+ public long? IssuedAt { get; set; }
+
+ ///
+ /// The nonce value issued by the server.
+ ///
+ public string ServerIssuedNonce { get; set; }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidator.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidator.cs
new file mode 100644
index 00000000..effb21e8
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPProofValidator.cs
@@ -0,0 +1,484 @@
+using IdentityModel;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Tokens;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
+
+namespace DPoP.Api;
+
+public class DPoPProofValidator
+{
+ const string ReplayCachePurpose = "DPoPJwtBearerEvents-DPoPReplay-jti-";
+ const string DataProtectorPurpose = "DPoPJwtBearerEvents-DPoPProofValidation-nonce";
+
+ public readonly static IEnumerable SupportedDPoPSigningAlgorithms = new[]
+ {
+ SecurityAlgorithms.RsaSha256,
+ SecurityAlgorithms.RsaSha384,
+ SecurityAlgorithms.RsaSha512,
+
+ SecurityAlgorithms.RsaSsaPssSha256,
+ SecurityAlgorithms.RsaSsaPssSha384,
+ SecurityAlgorithms.RsaSsaPssSha512,
+
+ SecurityAlgorithms.EcdsaSha256,
+ SecurityAlgorithms.EcdsaSha384,
+ SecurityAlgorithms.EcdsaSha512
+ };
+
+ protected readonly IOptionsMonitor OptionsMonitor;
+ protected readonly IDataProtector DataProtector;
+ protected readonly IReplayCache ReplayCache;
+ protected readonly ILogger Logger;
+
+ public DPoPProofValidator(IOptionsMonitor optionsMonitor, IDataProtectionProvider dataProtectionProvider, IReplayCache replayCache, ILogger logger)
+ {
+ OptionsMonitor = optionsMonitor;
+ DataProtector = dataProtectionProvider.CreateProtector(DataProtectorPurpose);
+ ReplayCache = replayCache;
+ Logger = logger;
+ }
+
+ ///
+ public async Task ValidateAsync(DPoPProofValidatonContext context)
+ {
+ var result = new DPoPProofValidatonResult() { IsError = false };
+
+ try
+ {
+ if (String.IsNullOrEmpty(context?.ProofToken))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Missing DPoP proof value.";
+ return result;
+ }
+
+ await ValidateHeaderAsync(context, result);
+ if (result.IsError)
+ {
+ Logger.LogDebug("Failed to validate DPoP header");
+ return result;
+ }
+
+ await ValidateSignatureAsync(context, result);
+ if (result.IsError)
+ {
+ Logger.LogDebug("Failed to validate DPoP signature");
+ return result;
+ }
+
+ await ValidatePayloadAsync(context, result);
+ if (result.IsError)
+ {
+ Logger.LogDebug("Failed to validate DPoP payload");
+ return result;
+ }
+
+ Logger.LogDebug("Successfully validated DPoP proof token");
+ result.IsError = false;
+ }
+ finally
+ {
+ if (result.IsError)
+ {
+ result.Error = OidcConstants.TokenErrors.InvalidDPoPProof;
+ }
+ }
+
+ return result;
+ }
+
+ ///
+ /// Validates the header.
+ ///
+ protected virtual Task ValidateHeaderAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ JsonWebToken token;
+
+ try
+ {
+ var handler = new JsonWebTokenHandler();
+ token = handler.ReadJsonWebToken(context.ProofToken);
+ }
+ catch (Exception ex)
+ {
+ Logger.LogDebug("Error parsing DPoP token: {error}", ex.Message);
+ result.IsError = true;
+ result.ErrorDescription = "Malformed DPoP token.";
+ return Task.CompletedTask;
+ }
+
+ if (!token.TryGetHeaderValue("typ", out var typ) || typ != JwtClaimTypes.JwtTypes.DPoPProofToken)
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'typ' value.";
+ return Task.CompletedTask;
+ }
+
+ if (!token.TryGetHeaderValue("alg", out var alg) || !SupportedDPoPSigningAlgorithms.Contains(alg))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'alg' value.";
+ return Task.CompletedTask;
+ }
+
+ if (!token.TryGetHeaderValue>(JwtClaimTypes.JsonWebKey, out var jwkValues))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'jwk' value.";
+ return Task.CompletedTask;
+ }
+
+ var jwkJson = JsonSerializer.Serialize(jwkValues);
+
+ JsonWebKey jwk;
+ try
+ {
+ jwk = new JsonWebKey(jwkJson);
+ }
+ catch (Exception ex)
+ {
+ Logger.LogDebug("Error parsing DPoP jwk value: {error}", ex.Message);
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'jwk' value.";
+ return Task.CompletedTask;
+ }
+
+ if (jwk.HasPrivateKey)
+ {
+ result.IsError = true;
+ result.ErrorDescription = "'jwk' value contains a private key.";
+ return Task.CompletedTask;
+ }
+
+ result.JsonWebKey = jwkJson;
+ result.JsonWebKeyThumbprint = jwk.CreateThumbprint();
+ result.Confirmation = jwk.CreateThumbprintCnf();
+
+ return Task.CompletedTask;
+ }
+
+ ///
+ /// Validates the signature.
+ ///
+ protected virtual Task ValidateSignatureAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ TokenValidationResult tokenValidationResult;
+
+ try
+ {
+ var key = new JsonWebKey(result.JsonWebKey);
+ var tvp = new TokenValidationParameters
+ {
+ ValidateAudience = false,
+ ValidateIssuer = false,
+ ValidateLifetime = false,
+ IssuerSigningKey = key,
+ };
+
+ var handler = new JsonWebTokenHandler();
+ tokenValidationResult = handler.ValidateToken(context.ProofToken, tvp);
+ }
+ catch (Exception ex)
+ {
+ Logger.LogDebug("Error parsing DPoP token: {error}", ex.Message);
+ result.IsError = true;
+ result.ErrorDescription = "Invalid signature on DPoP token.";
+ return Task.CompletedTask;
+ }
+
+ if (tokenValidationResult.Exception != null)
+ {
+ Logger.LogDebug("Error parsing DPoP token: {error}", tokenValidationResult.Exception.Message);
+ result.IsError = true;
+ result.ErrorDescription = "Invalid signature on DPoP token.";
+ return Task.CompletedTask;
+ }
+
+ result.Payload = tokenValidationResult.Claims;
+
+ return Task.CompletedTask;
+ }
+
+ ///
+ /// Validates the payload.
+ ///
+ protected virtual async Task ValidatePayloadAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ if (result.Payload.TryGetValue(JwtClaimTypes.DPoPAccessTokenHash, out var ath))
+ {
+ result.AccessTokenHash = ath as string;
+ }
+
+ if (String.IsNullOrEmpty(result.AccessTokenHash))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'ath' value.";
+ return;
+ }
+
+ using (var sha = SHA256.Create())
+ {
+ var bytes = Encoding.UTF8.GetBytes(context.AccessToken);
+ var hash = sha.ComputeHash(bytes);
+
+ var accessTokenHash = Base64Url.Encode(hash);
+ if (accessTokenHash != result.AccessTokenHash)
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'ath' value.";
+ return;
+ }
+ }
+
+ if (result.Payload.TryGetValue(JwtClaimTypes.JwtId, out var jti))
+ {
+ result.TokenId = jti as string;
+ }
+
+ if (String.IsNullOrEmpty(result.TokenId))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'jti' value.";
+ return;
+ }
+
+ if (!result.Payload.TryGetValue(JwtClaimTypes.DPoPHttpMethod, out var htm) || !context.Method.Equals(htm))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'htm' value.";
+ return;
+ }
+
+ if (!result.Payload.TryGetValue(JwtClaimTypes.DPoPHttpUrl, out var htu) || !context.Url.Equals(htu))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'htu' value.";
+ return;
+ }
+
+ if (result.Payload.TryGetValue(JwtClaimTypes.IssuedAt, out var iat))
+ {
+ if (iat is int)
+ {
+ result.IssuedAt = (int) iat;
+ }
+ if (iat is long)
+ {
+ result.IssuedAt = (long) iat;
+ }
+ }
+
+ if (!result.IssuedAt.HasValue)
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Missing 'iat' value.";
+ return;
+ }
+
+ if (result.Payload.TryGetValue(JwtClaimTypes.Nonce, out var nonce))
+ {
+ result.Nonce = nonce as string;
+ }
+
+ await ValidateFreshnessAsync(context, result);
+ if (result.IsError)
+ {
+ Logger.LogDebug("Failed to validate DPoP token freshness");
+ return;
+ }
+
+ // we do replay at the end so we only add to the reply cache if everything else is ok
+ await ValidateReplayAsync(context, result);
+ if (result.IsError)
+ {
+ Logger.LogDebug("Detected replay of DPoP token");
+ return;
+ }
+ }
+
+ ///
+ /// Validates is the token has been replayed.
+ ///
+ protected virtual async Task ValidateReplayAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ var dpopOptions = OptionsMonitor.Get(context.Scheme);
+
+ if (await ReplayCache.ExistsAsync(ReplayCachePurpose, result.TokenId))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Detected DPoP proof token replay.";
+ return;
+ }
+
+ // get largest skew based on how client's freshness is validated
+ var validateIat = dpopOptions.ValidateIat;
+ var validateNonce = dpopOptions.ValidateNonce;
+ var skew = TimeSpan.Zero;
+ if (validateIat && dpopOptions.ClientClockSkew > skew)
+ {
+ skew = dpopOptions.ClientClockSkew;
+ }
+ if (validateNonce && dpopOptions.ServerClockSkew > skew)
+ {
+ skew = dpopOptions.ServerClockSkew;
+ }
+
+ // we do x2 here because clock might be might be before or after, so we're making cache duration
+ // longer than the likelyhood of proof token expiration, which is done before replay
+ skew *= 2;
+ var cacheDuration = dpopOptions.ProofTokenValidityDuration + skew;
+ await ReplayCache.AddAsync(ReplayCachePurpose, result.TokenId, DateTimeOffset.UtcNow.Add(cacheDuration));
+ }
+
+ ///
+ /// Validates the freshness.
+ ///
+ protected virtual async Task ValidateFreshnessAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ var dpopOptions = OptionsMonitor.Get(context.Scheme);
+
+ var validateIat = dpopOptions.ValidateIat;
+ if (validateIat)
+ {
+ await ValidateIatAsync(context, result);
+ if (result.IsError)
+ {
+ return;
+ }
+ }
+
+ var validateNonce = dpopOptions.ValidateNonce;
+ if (validateNonce)
+ {
+ await ValidateNonceAsync(context, result);
+ if (result.IsError)
+ {
+ return;
+ }
+ }
+ }
+
+ ///
+ /// Validates the freshness of the iat value.
+ ///
+ protected virtual Task ValidateIatAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ var dpopOptions = OptionsMonitor.Get(context.Scheme);
+
+ if (IsExpired(context, result, dpopOptions.ClientClockSkew, result.IssuedAt.Value))
+ {
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'iat' value.";
+ return Task.CompletedTask;
+ }
+
+ return Task.CompletedTask;
+ }
+
+ ///
+ /// Validates the freshness of the nonce value.
+ ///
+ protected virtual async Task ValidateNonceAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ if (String.IsNullOrWhiteSpace(result.Nonce))
+ {
+ result.IsError = true;
+ result.Error = OidcConstants.TokenErrors.UseDPoPNonce;
+ result.ErrorDescription = "Missing 'nonce' value.";
+ result.ServerIssuedNonce = CreateNonce(context, result);
+ return;
+ }
+
+ var time = await GetUnixTimeFromNonceAsync(context, result);
+ if (time <= 0)
+ {
+ Logger.LogDebug("Invalid time value read from the 'nonce' value");
+
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'nonce' value.";
+ result.ServerIssuedNonce = CreateNonce(context, result);
+ return;
+ }
+
+ var dpopOptions = OptionsMonitor.Get(context.Scheme);
+
+ if (IsExpired(context, result, dpopOptions.ServerClockSkew, time))
+ {
+ Logger.LogDebug("DPoP 'nonce' expiration failed. It's possible that the server farm clocks might not be closely synchronized, so consider setting the ServerClockSkew on the DPoPOptions on the IdentityServerOptions.");
+
+ result.IsError = true;
+ result.ErrorDescription = "Invalid 'nonce' value.";
+ result.ServerIssuedNonce = CreateNonce(context, result);
+ return;
+ }
+ }
+
+ ///
+ /// Creates a nonce value to return to the client.
+ ///
+ ///
+ protected virtual string CreateNonce(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+ return DataProtector.Protect(now.ToString());
+ }
+
+ ///
+ /// Reads the time the nonce was created.
+ ///
+ ///
+ protected virtual ValueTask GetUnixTimeFromNonceAsync(DPoPProofValidatonContext context, DPoPProofValidatonResult result)
+ {
+ try
+ {
+ var value = DataProtector.Unprotect(result.Nonce);
+ if (Int64.TryParse(value, out long iat))
+ {
+ return ValueTask.FromResult(iat);
+ }
+ }
+ catch (Exception ex)
+ {
+ Logger.LogDebug("Error parsing DPoP 'nonce' value: {error}", ex.ToString());
+ }
+
+ return ValueTask.FromResult(0);
+ }
+
+ ///
+ /// Validates the expiration of the DPoP proof.
+ /// Returns true if the time is beyond the allowed limits, false otherwise.
+ ///
+ protected virtual bool IsExpired(DPoPProofValidatonContext context, DPoPProofValidatonResult result, TimeSpan clockSkew, long issuedAtTime)
+ {
+ var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+ var start = now + (int) clockSkew.TotalSeconds;
+ if (start < issuedAtTime)
+ {
+ var diff = issuedAtTime - now;
+ Logger.LogDebug("Expiration check failed. Creation time was too far in the future. The time being checked was {iat}, and clock is now {now}. The time difference is {diff}", issuedAtTime, now, diff);
+ return true;
+ }
+
+ var dpopOptions = OptionsMonitor.Get(context.Scheme);
+ var expiration = issuedAtTime + (int) dpopOptions.ProofTokenValidityDuration.TotalSeconds;
+ var end = now - (int) clockSkew.TotalSeconds;
+ if (expiration < end)
+ {
+ var diff = now - expiration;
+ Logger.LogDebug("Expiration check failed. Expiration has already happened. The expiration was at {exp}, and clock is now {now}. The time difference is {diff}", expiration, now, diff);
+ return true;
+ }
+
+ return false;
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPServiceCollectionExtensions.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPServiceCollectionExtensions.cs
new file mode 100644
index 00000000..6ff844ed
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DPoPServiceCollectionExtensions.cs
@@ -0,0 +1,30 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using System;
+
+namespace DPoP.Api;
+
+static class DPoPServiceCollectionExtensions
+{
+ public static IServiceCollection ConfigureDPoPTokensForScheme(this IServiceCollection services, string scheme)
+ {
+ services.AddOptions();
+
+ services.AddTransient();
+ services.AddTransient();
+ services.AddDistributedMemoryCache();
+ services.AddTransient();
+
+ services.AddSingleton>(new ConfigureJwtBearerOptions(scheme));
+
+
+ return services;
+ }
+
+ public static IServiceCollection ConfigureDPoPTokensForScheme(this IServiceCollection services, string scheme, Action configure)
+ {
+ services.Configure(scheme, configure);
+ return services.ConfigureDPoPTokensForScheme(scheme);
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DefaultReplayCache.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DefaultReplayCache.cs
new file mode 100644
index 00000000..db098ba0
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/DefaultReplayCache.cs
@@ -0,0 +1,41 @@
+using Microsoft.Extensions.Caching.Distributed;
+using System;
+using System.Threading.Tasks;
+
+namespace DPoP.Api;
+
+///
+/// Default implementation of the replay cache using IDistributedCache
+///
+public class DefaultReplayCache : IReplayCache
+{
+ private const string Prefix = nameof(DefaultReplayCache) + "-";
+
+ private readonly IDistributedCache _cache;
+
+ ///
+ /// ctor
+ ///
+ ///
+ public DefaultReplayCache(IDistributedCache cache)
+ {
+ _cache = cache;
+ }
+
+ ///
+ public async Task AddAsync(string purpose, string handle, DateTimeOffset expiration)
+ {
+ var options = new DistributedCacheEntryOptions
+ {
+ AbsoluteExpiration = expiration
+ };
+
+ await _cache.SetAsync(Prefix + purpose + handle, new byte[] { }, options);
+ }
+
+ ///
+ public async Task ExistsAsync(string purpose, string handle)
+ {
+ return (await _cache.GetAsync(Prefix + purpose + handle, default)) != null;
+ }
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/IReplayCache.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/IReplayCache.cs
new file mode 100644
index 00000000..b0701901
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/DPoP/IReplayCache.cs
@@ -0,0 +1,25 @@
+using System;
+using System.Threading.Tasks;
+
+namespace DPoP.Api;
+
+public interface IReplayCache
+{
+ ///
+ /// Adds a handle to the cache
+ ///
+ ///
+ ///
+ ///
+ ///
+ Task AddAsync(string purpose, string handle, DateTimeOffset expiration);
+
+
+ ///
+ /// Checks if a cached handle exists
+ ///
+ ///
+ ///
+ ///
+ Task ExistsAsync(string purpose, string handle);
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/EchoController.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/EchoController.cs
new file mode 100644
index 00000000..b0a33399
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/EchoController.cs
@@ -0,0 +1,45 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Microsoft.AspNetCore.Mvc;
+using System;
+using Microsoft.AspNetCore.Authorization;
+
+namespace DPoP.Api
+{
+ [AllowAnonymous]
+ public class EchoController : ControllerBase
+ {
+ [HttpGet("{**catch-all}")]
+ public IActionResult Get()
+ {
+ string message;
+ var sub = User.FindFirst("sub");
+
+ if (!User.Identity.IsAuthenticated)
+ {
+ message = "Hello, anonymous caller";
+ }
+ else if (sub != null)
+ {
+ var userName = User.FindFirst("name");
+ message = $"Hello user, {userName.Value}";
+ }
+ else
+ {
+ var client = User.FindFirst("client_id");
+ message = $"Hello client, {client.Value}";
+ }
+
+ var response = new
+ {
+ path = Request.Path.Value,
+ message = message,
+ time = DateTime.UtcNow.ToString(),
+ headers = Request.Headers
+ };
+
+ return Ok(response);
+ }
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/Program.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/Program.cs
new file mode 100644
index 00000000..f0816e96
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/Program.cs
@@ -0,0 +1,57 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using System;
+using System.Diagnostics;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Hosting;
+using Serilog;
+using Serilog.Events;
+using Serilog.Sinks.SystemConsole.Themes;
+
+namespace DPoP.Api
+{
+ public class Program
+ {
+ public static int Main(string[] args)
+ {
+ Activity.DefaultIdFormat = ActivityIdFormat.W3C;
+
+ Log.Logger = new LoggerConfiguration()
+ .MinimumLevel.Debug()
+ .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
+ .MinimumLevel.Override("Microsoft.Hosting.Lifetime", LogEventLevel.Information)
+ .MinimumLevel.Override("System", LogEventLevel.Warning)
+ .MinimumLevel.Override("Microsoft.AspNetCore.Authentication", LogEventLevel.Information)
+ .Enrich.FromLogContext()
+ .WriteTo.Console(outputTemplate: "[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}", theme: AnsiConsoleTheme.Code)
+ .CreateLogger();
+
+ try
+ {
+ Log.Information("Starting host...");
+ CreateHostBuilder(args).Build().Run();
+ return 0;
+ }
+ catch (Exception ex)
+ {
+ Log.Fatal(ex, "Host terminated unexpectedly.");
+ return 1;
+ }
+ finally
+ {
+ Log.CloseAndFlush();
+ }
+ }
+
+ public static IHostBuilder CreateHostBuilder(string[] args)
+ {
+ return Host.CreateDefaultBuilder(args)
+ .UseSerilog()
+ .ConfigureWebHostDefaults(webBuilder =>
+ {
+ webBuilder.UseStartup();
+ });
+ }
+ }
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/Properties/launchSettings.json b/IdentityServer/v6/BFF/DPoP/DPoP.Api/Properties/launchSettings.json
new file mode 100644
index 00000000..6507b1ae
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/Properties/launchSettings.json
@@ -0,0 +1,13 @@
+{
+ "profiles": {
+ "Api": {
+ "commandName": "Project",
+ "dotnetRunMessages": true,
+ "launchBrowser": false,
+ "applicationUrl": "https://localhost:6001",
+ "environmentVariables": {
+ "ASPNETCORE_ENVIRONMENT": "Development"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Api/Startup.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Api/Startup.cs
new file mode 100644
index 00000000..2554e0d5
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Api/Startup.cs
@@ -0,0 +1,87 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.IdentityModel.Tokens;
+using Serilog;
+
+namespace DPoP.Api
+{
+ public class Startup
+ {
+ public void ConfigureServices(IServiceCollection services)
+ {
+ services.AddControllers();
+
+ services.AddAuthentication("token")
+ .AddJwtBearer("token", options =>
+ {
+ options.Authority = "https://demo.duendesoftware.com";
+ options.MapInboundClaims = false;
+
+ options.TokenValidationParameters = new TokenValidationParameters()
+ {
+ ValidateAudience = false,
+ ValidTypes = new[] { "at+jwt" },
+
+ NameClaimType = "name",
+ RoleClaimType = "role"
+ };
+ });
+
+ // layers DPoP onto the "token" scheme above
+ services.ConfigureDPoPTokensForScheme("token");
+
+ services.AddAuthorization(options =>
+ {
+ options.AddPolicy("ApiCaller", policy =>
+ {
+ policy.RequireClaim("scope", "api");
+ });
+
+ options.AddPolicy("RequireInteractiveUser", policy =>
+ {
+ policy.RequireClaim("sub");
+ });
+ });
+ }
+
+ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
+ {
+ // The BFF sets the X-Forwarded-* headers to reflect that it
+ // forwarded the request here. Using the forwarded headers
+ // middleware here would therefore change the request's host to be
+ // the bff instead of this API, which is not what the DPoP
+ // validation code expects when it checks the htu value. If this API
+ // were hosted behind a load balancer, you might need to add back
+ // the forwarded headers middleware, or consider changing the DPoP
+ // proof validation.
+
+ // app.UseForwardedHeaders(new ForwardedHeadersOptions
+ // {
+ // ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost,
+ // });
+
+ app.UseSerilogRequestLogging();
+
+ if (env.IsDevelopment())
+ {
+ app.UseDeveloperExceptionPage();
+ }
+
+ app.UseRouting();
+ app.UseAuthentication();
+ app.UseAuthorization();
+
+ app.UseEndpoints(endpoints =>
+ {
+ endpoints.MapControllers()
+ .RequireAuthorization("ApiCaller");
+ });
+ }
+ }
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/DPoP.Bff.csproj b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/DPoP.Bff.csproj
new file mode 100644
index 00000000..325eed12
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/DPoP.Bff.csproj
@@ -0,0 +1,14 @@
+
+
+
+ net6.0
+ Host6
+ enable
+
+
+
+
+
+
+
+
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/LocalApiController.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/LocalApiController.cs
new file mode 100644
index 00000000..f5298f47
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/LocalApiController.cs
@@ -0,0 +1,51 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+
+namespace DPoP.BFF;
+[Route("local")]
+public class LocalApiController : ControllerBase
+{
+ private readonly IHttpClientFactory _httpClientFactory;
+
+ public LocalApiController(IHttpClientFactory httpClientFactory)
+ {
+ _httpClientFactory = httpClientFactory;
+ }
+
+ [Route("self-contained")]
+ [HttpGet]
+ public IActionResult SelfContained()
+ {
+ var data = new
+ {
+ Message = "Hello from self-contained local API",
+ User = User!.FindFirst("name")?.Value ?? User!.FindFirst("sub")!.Value
+ };
+
+ return Ok(data);
+ }
+
+ [Route("invokes-external-api")]
+ [HttpGet]
+ public async Task InvokesExternalApisAsync()
+ {
+ var httpClient = _httpClientFactory.CreateClient("api");
+ var apiResult = await httpClient.GetAsync("/user-token");
+ var content = await apiResult.Content.ReadAsStringAsync();
+ var deserialized = JsonSerializer.Deserialize>(content);
+
+ var data = new
+ {
+ Message = "Hello from local API that invokes a remote api",
+ RemoteApiResponse = deserialized
+ };
+
+ return Ok(data);
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Program.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Program.cs
new file mode 100644
index 00000000..0c4e3e54
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Program.cs
@@ -0,0 +1,54 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using System;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Hosting;
+using Serilog;
+using Serilog.Events;
+using Serilog.Sinks.SystemConsole.Themes;
+
+namespace DPoP.BFF;
+
+public class Program
+{
+ public static int Main(string[] args)
+ {
+ Log.Logger = new LoggerConfiguration()
+ .MinimumLevel.Information()
+ .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
+ .MinimumLevel.Override("Microsoft.Hosting.Lifetime", LogEventLevel.Information)
+ .MinimumLevel.Override("Microsoft.AspNetCore.Authentication", LogEventLevel.Information)
+ .MinimumLevel.Override("IdentityModel", LogEventLevel.Debug)
+ .MinimumLevel.Override("Duende.Bff", LogEventLevel.Debug)
+ .Enrich.FromLogContext()
+ .WriteTo.Console(outputTemplate: "[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}", theme: AnsiConsoleTheme.Code)
+ .CreateLogger();
+
+ try
+ {
+ Log.Information("Starting host...");
+ CreateHostBuilder(args).Build().Run();
+ return 0;
+ }
+ catch (Exception ex)
+ {
+ Log.Fatal(ex, "Host terminated unexpectedly.");
+ return 1;
+ }
+ finally
+ {
+ Log.CloseAndFlush();
+ }
+ }
+
+ public static IHostBuilder CreateHostBuilder(string[] args)
+ {
+ return Host.CreateDefaultBuilder(args)
+ .UseSerilog()
+ .ConfigureWebHostDefaults(webBuilder =>
+ {
+ webBuilder.UseStartup();
+ });
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Properties/launchSettings.json b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Properties/launchSettings.json
new file mode 100644
index 00000000..0cceaadb
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Properties/launchSettings.json
@@ -0,0 +1,13 @@
+{
+ "profiles": {
+ "Host6": {
+ "commandName": "Project",
+ "dotnetRunMessages": true,
+ "launchBrowser": true,
+ "applicationUrl": "https://localhost:5002",
+ "environmentVariables": {
+ "ASPNETCORE_ENVIRONMENT": "Development"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Startup.cs b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Startup.cs
new file mode 100644
index 00000000..03e81659
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/Startup.cs
@@ -0,0 +1,210 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Duende.Bff;
+using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using Serilog;
+using Yarp.ReverseProxy.Configuration;
+
+
+namespace DPoP.BFF;
+
+public class Startup
+{
+ public void ConfigureServices(IServiceCollection services)
+ {
+ var builder = services.AddReverseProxy()
+ .AddBffExtensions();
+
+ builder.LoadFromMemory(
+ new[]
+ {
+ new RouteConfig()
+ {
+ RouteId = "user-token",
+ ClusterId = "cluster1",
+
+ Match = new()
+ {
+ Path = "/yarp/user-token/{**catch-all}"
+ }
+ }.WithAccessToken(TokenType.User).WithAntiforgeryCheck(),
+ new RouteConfig()
+ {
+ RouteId = "client-token",
+ ClusterId = "cluster1",
+
+ Match = new()
+ {
+ Path = "/yarp/client-token/{**catch-all}"
+ }
+ }.WithAccessToken(TokenType.Client).WithAntiforgeryCheck(),
+ new RouteConfig()
+ {
+ RouteId = "user-or-client-token",
+ ClusterId = "cluster1",
+
+ Match = new()
+ {
+ Path = "/yarp/user-or-client-token/{**catch-all}"
+ }
+ }.WithAccessToken(TokenType.UserOrClient).WithAntiforgeryCheck(),
+ new RouteConfig()
+ {
+ RouteId = "anonymous",
+ ClusterId = "cluster1",
+
+ Match = new()
+ {
+ Path = "/yarp/anonymous/{**catch-all}"
+ }
+ }.WithAntiforgeryCheck()
+ },
+ new[]
+ {
+ new ClusterConfig
+ {
+ ClusterId = "cluster1",
+
+ Destinations = new Dictionary(StringComparer.OrdinalIgnoreCase)
+ {
+ { "destination1", new() { Address = "https://localhost:6001" } },
+ }
+ }
+ });
+
+ // Add BFF services to DI - also add server-side session management
+ services.AddBff(options =>
+ {
+ var rsaKey = new RsaSecurityKey(RSA.Create(2048));
+ var jwkKey = JsonWebKeyConverter.ConvertFromSecurityKey(rsaKey);
+ jwkKey.Alg = "PS256";
+ var jwk = JsonSerializer.Serialize(jwkKey);
+ options.DPoPJsonWebKey = jwk;
+ })
+ .AddRemoteApis()
+ .AddServerSideSessions();
+
+ // local APIs
+ services.AddControllers();
+
+ // cookie options
+ services.AddAuthentication(options =>
+ {
+ options.DefaultScheme = "cookie";
+ options.DefaultChallengeScheme = "oidc";
+ options.DefaultSignOutScheme = "oidc";
+ })
+ .AddCookie("cookie", options =>
+ {
+ // set session lifetime
+ options.ExpireTimeSpan = TimeSpan.FromHours(8);
+
+ // sliding or absolute
+ options.SlidingExpiration = false;
+
+ // host prefixed cookie name
+ options.Cookie.Name = "__Host-bff-dpop";
+
+ // strict SameSite handling
+ options.Cookie.SameSite = SameSiteMode.Strict;
+ })
+ .AddOpenIdConnect("oidc", options =>
+ {
+ options.Authority = "https://demo.duendesoftware.com";
+
+ // confidential client using code flow + PKCE
+ options.ClientId = "interactive.confidential";
+ options.ClientSecret = "secret";
+ options.ResponseType = "code";
+ options.ResponseMode = "query";
+
+ options.MapInboundClaims = false;
+ options.GetClaimsFromUserInfoEndpoint = true;
+ options.SaveTokens = true;
+
+ // request scopes + refresh tokens
+ options.Scope.Clear();
+ options.Scope.Add("openid");
+ options.Scope.Add("profile");
+ options.Scope.Add("api");
+ options.Scope.Add("offline_access");
+ });
+
+ services.AddUserAccessTokenHttpClient("api",
+ configureClient: client =>
+ {
+ client.BaseAddress = new Uri("https://localhost:6001/api");
+ });
+ }
+
+ public void Configure(IApplicationBuilder app)
+ {
+ app.UseSerilogRequestLogging();
+ app.UseDeveloperExceptionPage();
+
+ app.UseDefaultFiles();
+ app.UseStaticFiles();
+
+ app.UseAuthentication();
+ app.UseRouting();
+
+ // adds antiforgery protection for local APIs
+ app.UseBff();
+
+ // adds authorization for local and remote API endpoints
+ app.UseAuthorization();
+
+ app.UseEndpoints(endpoints =>
+ {
+ // local APIs
+ endpoints.MapControllers()
+ .RequireAuthorization()
+ .AsBffApiEndpoint();
+
+ // login, logout, user, backchannel logout...
+ endpoints.MapBffManagementEndpoints();
+
+ // proxy endpoints using yarp
+ endpoints.MapReverseProxy(proxyApp =>
+ {
+ proxyApp.UseAntiforgeryCheck();
+ });
+
+ // proxy endpoints using BFF's simplified wrapper
+ MapRemoteUrls(endpoints);
+ });
+ }
+
+ private static void MapRemoteUrls(IEndpointRouteBuilder endpoints)
+ {
+ // On this path, we use a client credentials token
+ endpoints.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:6001")
+ .RequireAccessToken(TokenType.Client);
+
+ // On this path, we use a user token if logged in, and fall back to a client credentials token if not
+ endpoints.MapRemoteBffApiEndpoint("/api/user-or-client-token", "https://localhost:6001")
+ .RequireAccessToken(TokenType.UserOrClient);
+
+ // On this path, we make anonymous requests
+ endpoints.MapRemoteBffApiEndpoint("/api/anonymous", "https://localhost:6001");
+
+ // On this path, we use the client token only if the user is logged in
+ endpoints.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:6001")
+ .WithOptionalUserAccessToken();
+
+ // On this path, we require the user token
+ endpoints.MapRemoteBffApiEndpoint("/api/user-token", "https://localhost:6001")
+ .WithUserAccessTokenParameter(new BffUserAccessTokenParameters(resource: "urn:example-api"))
+ .RequireAccessToken(TokenType.User);
+ }
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/StyleSheet.css b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/StyleSheet.css
new file mode 100644
index 00000000..2c1e366b
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/StyleSheet.css
@@ -0,0 +1,7 @@
+pre:empty {
+ display: none;
+}
+
+iframe {
+ display:none;
+}
\ No newline at end of file
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/app.js b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/app.js
new file mode 100644
index 00000000..17460cb3
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/app.js
@@ -0,0 +1,233 @@
+const loginUrl = "/bff/login";
+const silentLoginUrl = "/bff/silent-login";
+const userUrl = "/bff/user";
+const localApiUrl = "/local";
+const remoteApiUrl = "/api";
+const yarpApiUrl = "/yarp"
+let logoutUrl = "/bff/logout";
+
+async function onLoad() {
+ var req = new Request(userUrl, {
+ headers: new Headers({
+ 'X-CSRF': '1'
+ })
+ })
+
+ try {
+ var resp = await fetch(req);
+ if (resp.ok) {
+
+ let claims = await resp.json();
+ showUser(claims);
+
+ if (claims) {
+ log("user logged in");
+
+ let logoutUrlClaim = claims.find(claim => claim.type === 'bff:logout_url');
+ if (logoutUrlClaim) {
+ logoutUrl = logoutUrlClaim.value;
+ }
+ }
+ else {
+ log("user not logged in");
+ }
+ } else if (resp.status === 401) {
+ log("user not logged in");
+
+ // if we've detected that the user is no already logged in, we can attempt a silent login
+ // this will trigger a normal OIDC request in an iframe using prompt=none.
+ // if the user is already logged into IdentityServer, then the result will establish a session in the BFF.
+ // this whole process avoids redirecting the top window without knowing if the user is logged in or not.
+ var silentLoginResult = await silentLogin();
+
+ // the result is a boolean letting us know if the user has been logged in silently
+ log("silent login result: " + silentLoginResult);
+
+ if (silentLoginResult) {
+ // if we now have a user logged in silently, then reload this window
+ window.location.reload();
+ }
+ }
+ }
+ catch (e) {
+ log("error checking user status");
+ }
+}
+
+onLoad();
+
+function login() {
+ window.location = loginUrl;
+}
+
+function logout() {
+ window.location = logoutUrl;
+}
+
+async function callLocalApi(path) {
+ return await callApi(localApiUrl + path);
+}
+
+async function callRemoteApi(path) {
+ return await callApi(remoteApiUrl + path);
+}
+
+async function callYarpApi(path) {
+ return await callApi(yarpApiUrl + path);
+}
+
+async function callApi(path) {
+ var req = new Request(path, {
+ headers: new Headers({
+ 'X-CSRF': '1'
+ })
+ })
+ var resp = await fetch(req);
+
+ log("API Result: " + resp.status);
+ if (resp.ok) {
+ showApi(await resp.json());
+ } else {
+ showApi(resp.statusText)
+ }
+}
+
+async function callLocalSelfContainedApi() {
+ await callLocalApi("/self-contained")
+}
+
+async function callLocalApiThatInvokesExternalApi() {
+ await callLocalApi("/invokes-external-api")
+}
+
+async function callUserTokenApi() {
+ await callRemoteApi("/user-token");
+}
+
+async function callClientTokenApi() {
+ await callRemoteApi("/client-token");
+}
+
+async function callUserOrClientTokenApi() {
+ await callRemoteApi("/user-or-client-token");
+}
+
+async function callAnonymousApi() {
+ await callRemoteApi("/anonymous");
+}
+
+async function callOptionalUserTokenApi() {
+ await callRemoteApi("/optional-user-token");
+}
+
+async function callYarpAnonymousApi() {
+ await callYarpApi("/anonymous");
+}
+
+async function callYarpUserTokenApi() {
+ await callYarpApi("/user-token");
+}
+
+async function callYarpClientTokenApi() {
+ await callYarpApi("/client-token");
+}
+
+async function callYarpUserOrClientTokenApi() {
+ await callYarpApi("/user-or-client-token");
+}
+
+
+// User Management
+document.querySelector(".login").addEventListener("click", login, false);
+document.querySelector(".logout").addEventListener("click", logout, false);
+
+// Local APIs
+document.querySelector(".call_local_self_contained").addEventListener("click", callLocalSelfContainedApi, false);
+document.querySelector(".call_local_external").addEventListener("click", callLocalApiThatInvokesExternalApi, false);
+
+// Remote APIs
+document.querySelector(".call_anonymous").addEventListener("click", callAnonymousApi, false);
+document.querySelector(".call_user").addEventListener("click", callUserTokenApi, false);
+document.querySelector(".call_optional_user").addEventListener("click", callOptionalUserTokenApi, false);
+document.querySelector(".call_client").addEventListener("click", callClientTokenApi, false);
+document.querySelector(".call_user_or_client").addEventListener("click", callUserOrClientTokenApi, false);
+
+// Yarp APIs
+document.querySelector(".call_yarp_anonymous").addEventListener("click", callYarpAnonymousApi, false);
+document.querySelector(".call_yarp_user").addEventListener("click", callYarpUserTokenApi, false);
+document.querySelector(".call_yarp_client").addEventListener("click", callYarpClientTokenApi, false);
+document.querySelector(".call_yarp_user_or_client").addEventListener("click", callYarpUserOrClientTokenApi, false);
+
+function showApi() {
+ document.getElementById('api-result').innerText = '';
+
+ Array.prototype.forEach.call(arguments, function (msg) {
+ if (msg instanceof Error) {
+ msg = "Error: " + msg.message;
+ } else if (typeof msg !== 'string') {
+ msg = JSON.stringify(msg, null, 2);
+ }
+ document.getElementById('api-result').innerText += msg + '\r\n';
+ });
+}
+
+function showUser() {
+ document.getElementById('user').innerText = '';
+
+ Array.prototype.forEach.call(arguments, function (msg) {
+ if (msg instanceof Error) {
+ msg = "Error: " + msg.message;
+ } else if (typeof msg !== 'string') {
+ msg = JSON.stringify(msg, null, 2);
+ }
+ document.getElementById('user').innerText += msg + '\r\n';
+ });
+}
+
+function log() {
+ document.getElementById('response').innerText = '';
+
+ Array.prototype.forEach.call(arguments, function (msg) {
+ if (msg instanceof Error) {
+ msg = "Error: " + msg.message;
+ } else if (typeof msg !== 'string') {
+ msg = JSON.stringify(msg, null, 2);
+ }
+ document.getElementById('response').innerText += msg + '\r\n';
+ });
+}
+
+
+// this will trigger the silent login and return a promise that resolves to true or false.
+function silentLogin(iframeSelector) {
+ iframeSelector = iframeSelector || "#bff-silent-login";
+ const timeout = 5000;
+
+ return new Promise((resolve, reject) => {
+ function onMessage(e) {
+ // look for messages sent from the BFF iframe
+ if (e.data && e.data['source'] === 'bff-silent-login') {
+ window.removeEventListener("message", onMessage);
+ // send along the boolean result
+ resolve(e.data.isLoggedIn);
+ }
+ };
+
+ // listen for the iframe response to notify its parent (i.e. this window).
+ window.addEventListener("message", onMessage);
+
+ // we're setting up a time to handle scenarios when the iframe doesn't return immediaetly (despite prompt=none).
+ // this likely means the iframe is showing the error page at IdentityServer (typically due to client misconfiguration).
+ window.setTimeout(() => {
+ window.removeEventListener("message", onMessage);
+
+ // we can either just treat this like a "not logged in"
+ resolve(false);
+ // or we can trigger an error, so someone can look into the reason why
+ // reject(new Error("timed_out"));
+ }, timeout);
+
+ // send the iframe to the silent login endpoint to kick off the workflow
+ document.querySelector(iframeSelector).src = silentLoginUrl;
+ });
+}
diff --git a/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/index.html b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/index.html
new file mode 100644
index 00000000..e0514de4
--- /dev/null
+++ b/IdentityServer/v6/BFF/DPoP/DPoP.Bff/wwwroot/index.html
@@ -0,0 +1,92 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+