DuendeSoftware / IdentityServer

The most flexible and standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core
https://duendesoftware.com/products/identityserver
Other
1.49k stars 344 forks source link

Add custom validator for Introspection #1609

Open josephdecock opened 1 month ago

josephdecock commented 1 month ago

Add an ICustomIntrospectionValidator, similar to other ICustomXXXValidators.

You might do this to enforce resource isolation during introspection (IOW, if api1 introspects a token with audience api2, you might want to disallow that).

The introspection validator is internal, so if you want to customize it today, you would need to use a decorator.