DeviceCodeGrant - EasyAF.AI

Definition

Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.Object

Syntax

Microsoft.OData.Mcp.Authentication.Outbound.DeviceCodeGrant

Summary

Runs the RFC 8628 device authorization grant: start the grant at the device authorization endpoint, then poll the token endpoint honoring interval, slow_down, and authorization_pending until a token is issued, the code expires, or the end user denies it.

Remarks

Per specs/v3/AUTHENTICATION.md “Grants → Device code (RFC 8628)” the device_authorization_endpoint from metadata is always preferred; {issuer}/devicecode is a last-resort fallback, logged at Warning, used only when the server advertises the device code grant but publishes no endpoint for it. Per AUTH-12 the device code, user code, and every issued token stay out of the log: poll entries carry only the attempt number and the RFC error code. The device authorization request goes out on the "OAuth" named client directly; every token POST goes through TokenEndpointClient so that all token traffic in this package shares one code path.

Examples

var device = await deviceCodeGrant.StartAsync(metadata, clientId, "read offline_access", resource, cancellationToken);

Console.Error.WriteLine($"Enter {device.UserCode} at {device.VerificationUri}");

var response = await deviceCodeGrant.PollAsync(metadata, device, clientId, resource, cancellationToken);

Constructors

.ctor

Initializes a new instance of the DeviceCodeGrant class.

Syntax

public DeviceCodeGrant(System.Net.Http.IHttpClientFactory httpClientFactory, Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointClient tokenEndpointClient, Microsoft.Extensions.Logging.ILogger<Microsoft.OData.Mcp.Authentication.Outbound.DeviceCodeGrant> logger)

Parameters

Name	Type	Description
`httpClientFactory`	`System.Net.Http.IHttpClientFactory`	The factory used to create the `"OAuth"` named client for the device authorization request.
`tokenEndpointClient`	`Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointClient`	The client every token POST this grant sends goes through.
`logger`	`Microsoft.Extensions.Logging.ILogger<Microsoft.OData.Mcp.Authentication.Outbound.DeviceCodeGrant>`	The logger this instance records the endpoint fallback and each poll outcome to.

Exceptions

Exception	Description
`ArgumentNullException`	Thrown when httpClientFactory, tokenEndpointClient, or
logger is `null`.

.ctor Inherited

Inherited from object

Syntax

public Object()

Methods

Equals Inherited Virtual

Inherited from object

Syntax

public virtual bool Equals(object obj)

Parameters

Name	Type	Description
`obj`	`object?`	-

Returns

Type: bool

Equals Inherited

Inherited from object

Syntax

public static bool Equals(object objA, object objB)

Parameters

Name	Type	Description
`objA`	`object?`	-
`objB`	`object?`	-

Returns

Type: bool

GetHashCode Inherited Virtual

Inherited from object

Syntax

public virtual int GetHashCode()

Returns

Type: int

GetType Inherited

Inherited from object

Syntax

public System.Type GetType()

Returns

Type: System.Type

MemberwiseClone Inherited

Inherited from object

Syntax

protected internal object MemberwiseClone()

Returns

Type: object

PollAsync

Polls the token endpoint until the end user completes the grant, the device code expires, or the request is cancelled.

Syntax

public System.Threading.Tasks.Task<Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointResponse> PollAsync(Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata metadata, Microsoft.OData.Mcp.Authentication.Outbound.DeviceAuthorizationResponse device, string clientId, System.Uri resource, System.Threading.CancellationToken cancellationToken)

Parameters

Name	Type	Description
`metadata`	`Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata`	The authorization server metadata whose `token_endpoint` is polled.
`device`	`Microsoft.OData.Mcp.Authentication.Outbound.DeviceAuthorizationResponse`	The device authorization response CancellationToken) returned.
`clientId`	`string`	The public client identifier the grant was started with.
`resource`	`System.Uri?`	The RFC 8707 resource indicator, sent exactly as it was published or configured, or `null` when the grant sends none.
`cancellationToken`	`System.Threading.CancellationToken`	The token that cancels both the poll requests and the waits between them.

Returns

Type: System.Threading.Tasks.Task<Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointResponse> The successful token response.

Exceptions

Exception	Description
`ArgumentNullException`	Thrown when metadata or device is `null`.
`ArgumentException`	Thrown when clientId is `null`, empty, or whitespace, when
device carries no device code, or when it carries no positive `expires_in`.
`InvalidOperationException`	Thrown when metadata carries no token endpoint.
`OAuthTokenException`	Thrown with ODataMcpAuthConstants.ErrorExpiredToken when the device code’s lifetime
runs out, with ODataMcpAuthConstants.ErrorAccessDenied when the end user refuses, and
with whatever the server returned for any other error.

Examples

using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
timeout.CancelAfter(TimeSpan.FromSeconds(300));

var response = await deviceCodeGrant.PollAsync(metadata, device, clientId, resource, timeout.Token);
var container = response.ToTokenContainer(null, clientId, null, metadata.Issuer!, TokenEndpointClient.AuthMethodNone);

Remarks

The first wait is DeviceAuthorizationResponse.Interval seconds, floored at one second so a server that advertises zero cannot turn this into a hot loop; each slow_down adds DeviceCodeGrant.SlowDownIncrementSeconds seconds for the rest of the grant, per RFC 8628 section 3.5. The deadline is computed once from DeviceAuthorizationResponse.ExpiresIn at the first poll, so a slow server cannot extend the code’s life.

ReferenceEquals Inherited

Inherited from object

Syntax

public static bool ReferenceEquals(object objA, object objB)

Parameters

Name	Type	Description
`objA`	`object?`	-
`objB`	`object?`	-

Returns

Type: bool

StartAsync

Starts a device authorization grant and returns the codes the end user needs.

Syntax

public System.Threading.Tasks.Task<Microsoft.OData.Mcp.Authentication.Outbound.DeviceAuthorizationResponse> StartAsync(Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata metadata, string clientId, string scope, System.Uri resource, System.Threading.CancellationToken cancellationToken)

Parameters

Name	Type	Description
`metadata`	`Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata`	The authorization server metadata whose device authorization endpoint is used.
`clientId`	`string`	The public client identifier the grant is started for.
`scope`	`string?`	The space-delimited scope to request, or `null` to request none.
`resource`	`System.Uri?`	The RFC 8707 resource indicator, sent exactly as it was published or configured, or `null` when the grant sends none.
`cancellationToken`	`System.Threading.CancellationToken`	The token that cancels the request.

Returns

Type: System.Threading.Tasks.Task<Microsoft.OData.Mcp.Authentication.Outbound.DeviceAuthorizationResponse> The device authorization response, whose device code, user code, and verification URI are guaranteed non-empty.

Exceptions

Exception	Description
`ArgumentNullException`	Thrown when metadata is `null`.
`ArgumentException`	Thrown when clientId is `null`, empty, or whitespace.
`NotSupportedException`	Thrown when metadata publishes no device authorization endpoint and does not
advertise the device code grant either.
`OAuthTokenException`	Thrown when the server answers with a non-success status, when the response cannot be parsed, or
when it omits the device code, user code, or verification URI.

Remarks

scope and resource are sent only when supplied, so a server that rejects an empty scope or an unexpected resource never sees either.

ToString Inherited Virtual

Inherited from object

Syntax

public virtual string ToString()

Returns

Type: string?

​Definition

​Syntax

​Summary

​Remarks

​Examples

​Constructors

​ .ctor

​Syntax

​Parameters

​Exceptions

​ .ctor Inherited

​Syntax

​Methods

​ Equals Inherited Virtual

​Syntax

​Parameters

​Returns

​ Equals Inherited

​Syntax

​Parameters

​Returns

​ GetHashCode Inherited Virtual

​Syntax

​Returns

​ GetType Inherited

​Syntax

​Returns

​ MemberwiseClone Inherited

​Syntax

​Returns

​ PollAsync

​Syntax

​Parameters

​Returns

​Exceptions

​Examples

​Remarks

​ ReferenceEquals Inherited

​Syntax

​Parameters

​Returns

​ StartAsync

​Syntax

​Parameters

​Returns

​Exceptions

​Remarks

​ ToString Inherited Virtual

​Syntax

​Returns

Definition

Syntax

Summary

Remarks

Examples

Constructors

.ctor

Syntax

Parameters

Exceptions

.ctor Inherited

Syntax

Methods

Equals Inherited Virtual

Syntax

Parameters

Returns

Equals Inherited

Syntax

Parameters

Returns

GetHashCode Inherited Virtual

Syntax

Returns

GetType Inherited

Syntax

Returns

MemberwiseClone Inherited

Syntax

Returns

PollAsync

Syntax

Parameters

Returns

Exceptions

Examples

Remarks

ReferenceEquals Inherited

Syntax

Parameters

Returns

StartAsync

Syntax

Parameters

Returns

Exceptions

Remarks

ToString Inherited Virtual

Syntax

Returns