Tech stack:
- VueJS based frontend SPA app
- .Net6 Core API - using (latest) OpenIdDict 3.1 as a auth server
- Sql Server database
I am trying to implement some custom event handling within the OpenIdDict Validation to match similar JWT event handling that I already have working - the custom logic is around claim handling and ensuring that certain claims exist in the principal regardless of where the Token came from so the rest of the system downstream of the token stuff can do what it needs to do.
I have implemented overrides for the MessageReceived, AuthenticationFailed and TokenValidated events in the JWTBearerEvents and these work well for both OpenIdDict and non-OpenIdDict issued tokens.
However, it feels "more right" to use the builtin OpenIdDict Validation feature to validate OpenIdDict issued tokens, and so I'm exploring the idea of configuring those same event handlers overrides for the OpenIdDict validation handler too.
But...for the life of me, I cannot find any information/samples on how to do these specific things. I've read this article about the Event system and found a few examples in various codebases (all mainly focused around the OpenIdDictServerEvents, not the OpenIdDictValidationEvents which I think I need). With the code samples I have found, when I paste them into my project in Visual Studio - there are complaints from VS about missing types and interfaces but I have most of the OpenIdDict packages installed so now I'm wondering about the age of these samples...
Am I overthinking it or have I got the wrong idea about what the Validation feature is for/should do? Since I can do what I want to do with OpenIdDict tokens using the JWTBearer method, should I just stick with that? Would there be any advantage to implementing the events within the OpenIdDict over using JWTBearer?