Customize At_hash Validation in .NET Authorization framework

Question

I'm using .Net Core 3.1 authorization framework to make Openid flow, and redirect my authorization to a third-party provider, this is my configuration:

services.AddAuthorization(cfg =>
                {
                    cfg.AddPolicy("MyPolicy", cfgPolicy =>
                    {
                        cfgPolicy.AddRequirements().RequireAuthenticatedUser();
                        cfgPolicy.AddAuthenticationSchemes(OpenIdConnectDefaults.AuthenticationScheme);
                    });
                }).AddAuthentication(cfg =>
                {
                    cfg.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    cfg.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                })
                .AddCookie()
                .AddOpenIdConnect(cfg =>
                {
                    cfg.ClientId = authenticationConfig.ClientId;
                    cfg.ClientSecret = authenticationConfig.ClientSecret;
                    cfg.ResponseType = "code";
                    cfg.CallbackPath = "/login/callback";
                    cfg.GetClaimsFromUserInfoEndpoint = true;
                    cfg.Scope.Clear();
                    cfg.Scope.Add("openid");
                    cfg.Configuration = new OpenIdConnectConfiguration
                    {
                        AuthorizationEndpoint = authenticationConfig.UrlSts + "authorize",
                        TokenEndpoint = "https://interal.io/api/oauth/token",
                        UserInfoEndpoint = "https://interal.io/api/oauth/token_info"
                    };
                });

But I got an error at ValidationHash step within class OpenIdConnectProtocolValidator. My at_hash claim is generated in a different way, and not equals specified here:https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation.

How can I customize ValidateHash method within class OpenIdConnectProtocolValidator ??

Answer 1

It's possible to override the OpenIdConnectProtocolValidator with your own implementation.

public class CustomOpenIdConnectProtocolValidator : OpenIdConnectProtocolValidator
{
    protected override void ValidateAtHash(OpenIdConnectProtocolValidationContext validationContext)
    {
        // Custom validation.
    }
}

Than in the Startup.cs you can customize the protocol validator:

.AddOpenIdConnect(cfg =>
{
    cfg.ProtocolValidator = new CustomOpenIdConnectProtocolValidator();
});

But beware; the at_hash value should be the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access_token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header.

There's a reason the spec is the spec. You should have a good reason to deviate from the spec.