Interface IUmaTicketExchangeClient

Namespace

Keycloak.AuthServices.Sdk.Protection

Assembly

Keycloak.AuthServices.Sdk.dll

Client for exchanging UMA permission tickets at the Keycloak token endpoint.

public interface IUmaTicketExchangeClient

Remarks

Implements the UMA grant type (urn:ietf:params:oauth:grant-type:uma-ticket) to exchange permission tickets for RPTs (Requesting Party Tokens) or to submit permission requests for resource owner approval.

Methods

ExchangeTicketForRptAsync(string, string, CancellationToken)

Exchanges a UMA permission ticket for a Requesting Party Token (RPT).

Task<string?> ExchangeTicketForRptAsync(string accessToken, string ticket, CancellationToken cancellationToken = default)

Parameters

accessToken string

The bearer access token of the requesting party.

ticket string

The permission ticket received from the resource server's UMA challenge.

cancellationToken CancellationToken

Cancellation token.

Returns

Task<string>

The RPT access token string, or null if the exchange failed.

SubmitPermissionRequestAsync(string, string, CancellationToken)

Submits a permission request for resource owner approval.

Task<bool> SubmitPermissionRequestAsync(string accessToken, string ticket, CancellationToken cancellationToken = default)

Parameters

accessToken string

The bearer access token of the requesting party.

ticket string

The permission ticket received from the resource server's UMA challenge.

cancellationToken CancellationToken

Cancellation token.

Returns

Task<bool>

true if the permission request was submitted for owner approval; otherwise false.

Remarks

Uses the submit_request=true parameter in the UMA ticket exchange. When access is denied, Keycloak persists a pending permission request that the resource owner can approve.