This library takes a single internal NuGet dependency, on the foundation-layer SAIF.NetCore.ServiceContracts package, one direct external dependency on Okta.AspNetCore for OIDC token validation, and it makes its own outbound calls to Okta for the authorization-code flow and token refresh rather than delegating those calls to another SAIF library.
Supplies every service interface this library implements (IOidcSettings, IJwtRefreshService, IRoleClaimService, IClaimTransformCacheService, ILoginRedirectService, IJwtAuthorizationCookieClaimService, IUrlCaseService, IDataProtectionCertService), shared DTOs/enums (OidcAppCredentials, JwtSet, SystemType, CharacterCasing), and the IEnvironmentClient, IHttpJsonClient, ISaifLogService, ISystemHashService interfaces this library consumes at runtime.
Supplies StrictSecurityTokenValidator and OktaHttpMessageHandler, used by ConfigureOpenIdConnectOptions to harden ID-token validation and tag the backchannel HTTP handler for Okta requests.
Microsoft.AspNetCore
2.2.0
Legacy ASP.NET Core meta-package reference; the shared framework actually supplies the authentication/cookie/OpenIdConnect types used at runtime*.
Microsoft.Extensions.Options
3.1.18
Supplies IConfigureNamedOptions<T>, implemented by ConfigureCookieAuthenticationOptions and ConfigureOpenIdConnectOptions.
{OktaBaseUrl}{OktaAuthorizationServerUrl} discovery/authorize/token/userinfo endpoints (for example /oauth2/default/.well-known/openid-configuration)
GET / POST
ConfigureOpenIdConnectOptions.Configure
This library
—
Executes the OIDC authorization-code flow (metadata discovery, authorize redirect, token exchange, userinfo) through the ASP.NET Core OpenIdConnectHandler configured by this library*.
{OktaBaseUrl}{OktaAuthorizationServerUrl}{RefresnTokenUrl}{RefreshTokenQueryString}{refreshToken} (for example /oauth2/default/v1/token)
POST
JwtRefreshService.Refresh
This library
—
Refreshes an expired access/ID token pair by posting the refresh grant, as a query string, to Okta's token endpoint via the injected IHttpJsonClient (implemented by SAIF.NetCore.HttpClients).
The refresh-token POST sends the OAuth refresh grant in the request query string, and refreshToken is not URL-encoded, so the token can be exposed in HTTP client or Okta request logs (JwtRefreshService.Refresh)*.
The returned refresh_token from a successful refresh call is discarded (JwtRefreshService.Refresh builds JwtSet from only AccessToken/IdToken), so there is no refresh-token rotation handling.
Newtonsoft.Json and System.IdentityModel.Tokens.Jwt are used (RefreshTokenResult, RefreshJwtMiddleware, ConfigureOpenIdConnectOptions) but are not declared as direct PackageReferences; the library relies on these arriving transitively through Okta.AspNetCore or SAIF.NetCore.ServiceContracts*.
Microsoft.AspNetCore 2.2.0 and Microsoft.Extensions.Options 3.1.18 are out-of-support versions pinned on a net8.0/net10.0 library.
The role-transform cache (ClaimTransformationCacheService) is a singleton backed by a non-thread-safe Dictionary, so concurrent requests for different subjects can corrupt it.
The lookup-key typo RoleClaimIdentitifier is defined in this library's own Constants.cs (RoleClaimIdentitifierKey = "RoleClaimIdentitifier"), not in SAIF.NetCore.ServiceContracts; the IOidcSettings.RoleClaimIdentifier property in ServiceContracts is correctly spelled. It is used as-is and the matching test mocks the same typo, masking the defect. Separately, and unrelated to this typo, IOidcSettings in ServiceContracts itself has a distinct property-name typo, RefresnTokenUrl (missing an "h"), which this library's OidcSettings.RefresnTokenUrl implements as declared.
Okta.AspNetCore is a hard external dependency with no feed-confirmed record (feedStatus: not-found), so its provenance and supply-chain status are not tracked by the internal package feed the way same-repo packages are.
Note: Statements marked with * were inferred from code structure, naming conventions, or
contextual evidence where direct confirmation was not available in source artifacts. Statements
marked with ** could not be confirmed; treat as unknown until verified.
src/SAIF.NetCore.OIDC/Directory.Packages.props (central package management; declaring source for the Okta.AspNetCore/Microsoft.AspNetCore/Microsoft.Extensions.Options version numbers cited on this page)
src/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/IOidcSettings.cs (consumer dependency; source of the distinct RefresnTokenUrl interface-level typo)