Skip to content

Feature/pushed authorization requests - #73

Open
andrewclymer wants to merge 58 commits into
release/3.0.0from
feature/PushedAuthorizationRequests
Open

Feature/pushed authorization requests#73
andrewclymer wants to merge 58 commits into
release/3.0.0from
feature/PushedAuthorizationRequests

Conversation

@andrewclymer

@andrewclymer andrewclymer commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

Description

Initial implementation of PAR. Currently uses an InMemory store for the PAR requests. Looking for feedback and testing of the implementation. Will then work on EF store while this PR is being evaluated

Type of change

  • Bug fix
  • Feature
  • Refactoring
  • Documentation
  • Other

Does this PR introduce a breaking change?

Does the change cause existing functionality to not work as previously expected, or does the DB schema or C# public API surface change?

  • Yes
  • No

Testing

Full set of unit tests and end to end integration test from PAR request through to getting a token

LLM Usage

Used LLM to confirm the code has implemented PAR as per the RFC.

Other context

None

This was linked to issues Sep 7, 2026
OAuth 2.0 Pushed Authorization Requests (RFC 9126) #17
Open
PAR response generator #22
Open
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/AspNetIdentity/src/Open.IdentityServer.AspNetIdentity.csproj Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/Endpoints/Results/PushedAuthorizationResult.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/Endpoints/Results/PushedAuthorizationResult.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/Endpoints/PushedAuthorizationEndpoint.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/Endpoints/PushedAuthorizationEndpoint.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/Endpoints/PushedAuthorizationEndpoint.cs
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/ResponseHandling/Models/PushedAuthorizationResponse.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/ResponseHandling/IAuthorizeInteractionResponseGenerator.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/ResponseHandling/IPushedAuthorizationResponseGenerator.cs Outdated
@patchandthat

patchandthat commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

Missing copyright headers on all your new files.

// Copyright (c) 2026, Rock Solid Knowledge Ltd
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.

Or insert on existing files

// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.

JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Storage/src/Stores/IPushedAuthorizationRequestStore.cs Outdated
JoStevensRSK
JoStevensRSK reviewed Sep 8, 2026
View reviewed changes
Comment thread src/Storage/src/Models/PushedAuthorizationMemento.cs
@patchandthat
patchandthat changed the base branch from main to release/3.0.0 September 8, 2026 15:40
patchandthat
patchandthat reviewed Sep 9, 2026
View reviewed changes
Comment thread src/Open.IdentityServer/src/Endpoints/Results/PushedAuthorizationResult.cs Outdated
@andrewclymer
Fixed capitalisation in docs
934271c
@andrewclymer
Grammar fix.
78f0466
@andrewclymer
Fixed docs, empty parameter description
5240706
@andrewclymer
Added missing summary for class
0e861d2
@andrewclymer
Missing param description
09645b4
@andrewclymer
Replaced empty summary for docs
c0433b5
@andrewclymer
Fixed grammar
e6dda62
@andrewclymer
Removed unused usings
fcdd75b
@andrewclymer
Removed blank line
3488766
@andrewclymer
Fixed grammer in docs
a4d054c
@andrewclymer
Add space after comma in generic argument list
8e335ba
@andrewclymer
Added description to params in doc
811edfa
@andrewclymer
Refactored to remove decorator for IAuthorizeRequestValidator, and mo…
268c9cd 
…ve the code from the decorator for PAR into the main validator and the AuthorizeEndpointBase

Added support for removal of PAR request once the authorization has been granted

Changed ReturnUrlResult so it uses the original raw parameters from the validation object, to ensure any callbacks use the original values, not the ones manipulated by the validation process, e.g. swapping out the original ones and replacing them with the values from a stored PAR
@andrewclymer
Removed files not used anymore after refactoring PAR processing
b2d07b6
@andrewclymer
Removed commented out code, left from a refactor
c32d8b8
@andrewclymer
Use method to create error response not using new directly
3ac13c0
@andrewclymer
Fixed the par store get to not remove, just get
ae24457 
add support for consent with PAR
@andrewclymer
Added client PAR configuration properties to EF mapping
0c0890b
@andrewclymer
Initial EF integration for PAR
46bd039
@andrewclymer
Fixed issue with converting database time to and from UTC
a5983c9
@andrewclymer
andrewclymer force-pushed the feature/PushedAuthorizationRequests branch from 837026e to df15e32 Compare September 16, 2026 08:29

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JoStevensRSK JoStevensRSK JoStevensRSK left review comments
@patchandthat patchandthat patchandthat approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

PAR response generator OAuth 2.0 Pushed Authorization Requests (RFC 9126)

4 participants

@andrewclymer @patchandthat @JoStevensRSK @richardblewett