ToolUp.AuthProviders.Oidc.Shared 0.39.2

ToolUp.AuthProviders.Oidc

Generic OIDC server-side IAuthProvider for ToolUp.Platform. Discovers JWKS via .well-known/openid-configuration, validates RS256 JWT bearer tokens against the discovered keys, and projects the resolved identity into AuthenticatedUser. Provider-agnostic — works against any OIDC-compliant issuer (Auth0, Cognito, Keycloak, etc.).

Key revocation window — read before deploying

By default this provider caches JWKS keys for 10 minutes and OIDC discovery metadata for 24 hours. So:

A signing key the issuer has revoked keeps validating tokens on a given instance for up to 10 minutes while the issuer is reachable, and for as long as JWKS fetches keep failing. Once a refresh is failing, the provider prefers serving the last-known-good key set over failing every sign-in — the window is then bounded by provider availability, not by the TTL.

That is a deliberate availability-over-revocation default, matching mainstream OIDC libraries: an issuer blip should not take your application down. If your threat model includes signing-key compromise, three opt-in knobs on OidcHardening change it, and every one defaults to the behaviour above:

• JwksCacheTtl — shorten the ordinary window. Some TimeSpan.Zero disables the JWKS cache entirely: every validation re-fetches and nothing is served from cache, stale fallback included. That is the tightest window this provider offers, at one round-trip per validated request.
• FailClosedOnStaleJwks — bound the outage window: a failing refresh surfaces the error rather than serving possibly-revoked keys. Sign-in fails while the IdP is unreachable; that is the trade.
• JwksEvictionSignal — bound the window across instances. A fetch failure publishes a CustomNotification on the platform-reserved scope; siblings subscribed via OidcJwksCache.subscribeToEvictions evict their own entry for that URL. Without it, a fleet's window is each instance's TTL measured independently. Requires a distributed notification channel — the in-process default reaches only the publishing process.

Not covered by any of them: per-token revocation. This provider does not perform token introspection (RFC 7662); revocation is observed only through the key set, so a revoked grant whose signing key is still published keeps validating until the token's exp. Keep access-token lifetimes short.

Full guidance, including the wiring snippet for the cross-instance signal, is in the SDK's auth-providers companion documentation.

Server-rendered sign-in failure page (Phase 1139)

OidcSsrSignIn answers every sign-in failure (missing, expired or mismatched state, an IdP error, a failed exchange, a refused token, a nonce mismatch, an already-expired token) with one small HTML page: a plain-language reason from a closed set, never IdP text, a token or an exception message, and a "Try again" link back to SignInPath carrying the validated return URL. Status codes, the no-cookie-on-failure rule and the open-redirect guard are unchanged; the page is no-store.

Out of the box the page carries minimal inline styling. To take the deployment's theme, name a stylesheet:

let page = OidcSsrSignIn.SignInPage.defaults |> OidcSsrSignIn.SignInPage.withStylesheet "/theme.css"
app |> OidcSsrSignIn.withInteractiveSignInPage page http config

withStylesheet refuses anything that is not a local, rooted path (an absolute URL, //host, whitespace, a quote, an angle bracket, a backtick or a backslash) with ArgumentException at composition, so a bad value stops the boot. The setting lives on SignInPage, not on OidcSsrSignInConfig: that record is unchanged, so every existing construction of it (full literal or defaults with { ... with }) keeps compiling, and routes / withInteractiveSignIn keep their signatures and use the default page. The inline style is dropped by a strict style-src CSP; the page then renders unstyled, which is still readable.

Licensed under Apache-2.0.

Part of the ToolUp Platform SDK — see github.com/ToolUp-Forge/toolup-forge for full documentation.