Fix stale ClientAssertion on DPoP nonce retry and missing assertion in OIDC code exchange by Erwinvandervalk · Pull Request #329 · DuendeSoftware/foss

Erwinvandervalk · 2026-02-27T13:31:39Z

No description provided.

Copilot

Pull request overview

This pull request fixes two critical issues with client assertions in DPoP-enabled OAuth/OIDC flows:

Stale client assertions on DPoP nonce retry: When authorization servers require unique jti (JWT ID) claims in client assertions, retrying a failed request with the same assertion causes rejection. This PR regenerates client assertions on DPoP nonce retries across all token request paths.
Missing assertions in OIDC code exchange: The OIDC authorization code exchange flow previously required manual PostConfigure workarounds to inject client assertions. This PR automatically injects them when IClientAssertionService is registered.

Changes:

Client assertion regeneration added to three DPoP nonce retry paths: client credentials, refresh token, and authorization code exchange
IClientAssertionService injection added to OIDC code exchange flow via ConfigureOpenIdConnectOptions
Fixed async/await bugs in OIDC event callbacks (inner callbacks were not awaited)
Added ClientAssertionFactory property to ProofTokenMessageHandler for OidcClient Extensions library
8 new tests verify the fixes work correctly and maintain backward compatibility

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`ClientCredentialsTokenClient.cs`	Regenerates client assertions on DPoP nonce retry for client credentials flow
`OpenIdConnectUserTokenEndpoint.cs`	Regenerates client assertions on DPoP nonce retry for refresh token flow
`ConfigureOpenIdConnectOptions.cs`	Injects `IClientAssertionService`, fixes async bugs, adds assertion to code exchange
`AuthorizationServerDPoPHandler.cs`	Accepts optional assertion service, rebuilds form body with fresh assertion on retry
`ProofTokenMessageHandler.cs`	Adds `ClientAssertionFactory` property, implements form body rebuilding on retry
`OidcClientExtensions.cs`	Wires up assertion factory when `GetClientAssertionAsync` is configured
`DPoPTests.cs`	Unit tests for `ProofTokenMessageHandler` assertion factory behavior
`UserTokenManagementWithDPoPTests.cs`	Integration tests for refresh and code exchange assertion regeneration
`UserTokenManagementTests.cs`	Updated test to remove `PostConfigure` workaround, adds automatic injection test
`ClientTokenManagementTests.cs`	Tests client credentials assertion regeneration on DPoP nonce retry

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

...management/src/AccessTokenManagement.OpenIdConnect/Internal/ConfigureOpenIdConnectOptions.cs

…n OIDC code exchange When DPoP nonce negotiation triggers a token request retry, regenerate the client assertion (private_key_jwt) so servers enforcing unique jti claims accept the retry. Also inject IClientAssertionService into the OIDC code-exchange flow so assertions are sent automatically without requiring manual PostConfigure workarounds. Five fix sites across two libraries: 1. ClientCredentialsTokenClient — re-invoke GetClientAssertionAsync before DPoP nonce retry (access-token-management) 2. OpenIdConnectUserTokenEndpoint — same pattern for refresh path 3. ConfigureOpenIdConnectOptions — inject IClientAssertionService, fix async bugs in CreateCallback, add assertion to OnAuthorizationCodeReceived 4. AuthorizationServerDPoPHandler — accept optional IClientAssertionService, rebuild form body with fresh assertion on nonce retry 5. ProofTokenMessageHandler — add optional ClientAssertionFactory callback, rebuild form body on nonce retry (identity-model-oidc-client) OidcClientExtensions.ConfigureDPoP() wires GetClientAssertionAsync to the token-endpoint handler's ClientAssertionFactory automatically. Backward compatible: NoOpClientAssertionService returns null, all new code paths null-check and skip. Static parameters.Assertion path is intentionally left unchanged. Closes #1392, closes #1393

Refactor client assertion regeneration to use a factory pattern that produces fresh JWTs (with unique jti) on each DPoP nonce retry attempt, preventing servers from rejecting replayed assertions. identity-model: - Add ProtocolRequestOptions.ClientAssertionFactory on HttpRequestMessage.Options - Add ClientAssertionFactory property to ProtocolRequest, wired into Clone<T>() - Invoke factory in RequestTokenAsync and PushAuthorizationAsync - Add ClientAssertions sample project identity-model-oidc-client: - Rewrite ProofTokenMessageHandler to read factory from request.Options - Remove handler-level ClientAssertionFactory property and WireClientAssertionFactory - Wire ClientAssertionFactory in AuthorizeClient, OidcClient, ResponseProcessor - Update NetCoreConsoleClient sample for DPoP + assertions - Switch to ProjectReference for cross-project visibility access-token-management: - Refactor AuthorizationServerDPoPHandler to resolve IClientAssertionService from DI (HttpContext.RequestServices) instead of constructor injection - Add integration test framework: JwtClientAssertionService, dpop-assertion client, JWT bearer auth, AppHost assertion wiring - Add DPoPWithClientAssertionsTests with full IdentityServer integration tests for code exchange, refresh token, and client credentials flows

josephdecock

Strongly recommend that we get a sample client running end to end for access token management.

josephdecock · 2026-03-04T13:33:44Z

identity-model-oidc-client/samples/NetCoreConsoleClient/src/NetCoreConsoleClient/Program.cs

+        // which ensures DPoP nonce retries don't replay a stale assertion.
+        var assertionService = new ClientAssertionService(
+            options.ClientId,
+            $"{_authority}/connect/token",


The audience must be the issuer identifier, not the token endpoint, as per RFC 7523 bis. In this case, the issuer identifier is "https://demo.duendesoftware.com".

josephdecock · 2026-03-04T13:59:00Z

access-token-management/test/AccessTokenManagement.Tests/Framework/JwtClientAssertionService.cs

+        var descriptor = new SecurityTokenDescriptor
+        {
+            Issuer = clientId,
+            Audience = "https://identityserver/connect/token",


Again, audience should be the issuer identifier.

josephdecock · 2026-03-04T14:02:20Z

identity-model/samples/ClientAssertions/Program.cs

+        var signingCredentials = ClientAssertionService.CreateSigningCredentials();
+
+        // 2. Create the assertion service.
+        var assertionService = new ClientAssertionService(ClientId, TokenEndpoint, signingCredentials);


Again, use issuer.

razor-slices/samples/PagesAndSlices/PagesAndSlices.csproj

josephdecock · 2026-03-05T13:13:22Z

...y-model-oidc-client/src/IdentityModel.OidcClient.Extensions/DPoP/ProofTokenMessageHandler.cs

    /// Constructor
    /// </summary>
    public ProofTokenMessageHandler(IDPoPProofTokenFactory dPoPProofTokenFactory, HttpMessageHandler innerHandler)
+        : this(dPoPProofTokenFactory, innerHandler, NullLogger<ProofTokenMessageHandler>.Instance)


NullLogger here feels bad. If we are going for avoiding a breaking change, isn't there something better we can pass to the base ctor that will actually log something?

Copilot AI review requested due to automatic review settings February 27, 2026 13:31

Copilot started reviewing on behalf of Erwinvandervalk February 27, 2026 13:32 View session

Copilot AI reviewed Feb 27, 2026

View reviewed changes

...management/src/AccessTokenManagement.OpenIdConnect/Internal/ConfigureOpenIdConnectOptions.cs Outdated Show resolved Hide resolved

Erwinvandervalk marked this pull request as draft February 27, 2026 13:37

Erwinvandervalk added 3 commits March 3, 2026 08:14

dotnet format

baf3e8f

Erwinvandervalk force-pushed the fix/dpop-stale-client-assertion-1392 branch from ed4a2c7 to cb31f00 Compare March 3, 2026 07:16

Erwinvandervalk added 3 commits March 3, 2026 08:19

cleanup

d85aaa5

Add null check for TokenEndpointRequest in code exchange callback

4c2135f

Revert unrelated razor-slices changes to match main

020892f

Erwinvandervalk marked this pull request as ready for review March 3, 2026 10:24

cleanup

d540673

josephdecock reviewed Mar 4, 2026

View reviewed changes

don't update razor slices

44ae365

josephdecock requested changes Mar 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix stale ClientAssertion on DPoP nonce retry and missing assertion in OIDC code exchange#329

Fix stale ClientAssertion on DPoP nonce retry and missing assertion in OIDC code exchange#329
Erwinvandervalk wants to merge 8 commits intomainfrom
fix/dpop-stale-client-assertion-1392

Erwinvandervalk commented Feb 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

josephdecock left a comment

Uh oh!

josephdecock Mar 4, 2026

Uh oh!

josephdecock Mar 4, 2026

Uh oh!

josephdecock Mar 4, 2026

Uh oh!

Uh oh!

josephdecock Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Erwinvandervalk commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

josephdecock left a comment

Choose a reason for hiding this comment

Uh oh!

josephdecock Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

josephdecock Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

josephdecock Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

josephdecock Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Erwinvandervalk commented Feb 27, 2026 •

edited

Loading