Feature/pushed authorization requests

src/AspNetIdentity/src/Open.IdentityServer.AspNetIdentity.csproj

@@ -42,7 +42,6 @@
 
     <ItemGroup>
         <PackageReference Include="Open.IdentityServer"/>
-
         <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All"/>
     </ItemGroup>
 

src/Open.IdentityServer/src/Configuration/DependencyInjection/BuilderExtensions/Core.cs

@@ -93,7 +93,7 @@ public static IIdentityServerBuilder AddDefaultEndpoints(this IIdentityServerBui
         builder.AddEndpoint<TokenRevocationEndpoint>(EndpointNames.Revocation, ProtocolRoutePaths.Revocation.EnsureLeadingSlash());
         builder.AddEndpoint<TokenEndpoint>(EndpointNames.Token, ProtocolRoutePaths.Token.EnsureLeadingSlash());
         builder.AddEndpoint<UserInfoEndpoint>(EndpointNames.UserInfo, ProtocolRoutePaths.UserInfo.EnsureLeadingSlash());
-
+        builder.AddEndpoint<PushedAuthorizationRequestEndpoint>(EndpointNames.PushedAuthorizationRequest, ProtocolRoutePaths.PushedAuthorizationRequest.EnsureLeadingSlash());
         return builder;
     }
 
@@ -182,6 +182,7 @@ public static IIdentityServerBuilder AddPluggableServices(this IIdentityServerBu
         builder.Services.TryAddTransient<IBackChannelLogoutService, DefaultBackChannelLogoutService>();
         builder.Services.TryAddTransient<IResourceValidator, DefaultResourceValidator>();
         builder.Services.TryAddTransient<IScopeParser, DefaultScopeParser>();
+        builder.Services.TryAddTransient<IPushedAuthorizationRequestService, DefaultPushedAuthorizationRequestService>();
 
         builder.Services.TryAddSingleton<ITelemetryService, DefaultTelemetryService>();
 
@@ -218,11 +219,15 @@ public static IIdentityServerBuilder AddValidators(this IIdentityServerBuilder b
         builder.Services.TryAddTransient<IClientConfigurationValidator, DefaultClientConfigurationValidator>();
         builder.Services.TryAddTransient<IDeviceAuthorizationRequestValidator, DeviceAuthorizationRequestValidator>();
         builder.Services.TryAddTransient<IDeviceCodeValidator, DeviceCodeValidator>();
-
+        builder.Services.TryAddTransient<IPushedAuthorizationRequestValidator, PushedAuthorizationRequestValidator>();
         // optional
         builder.Services.TryAddTransient<ICustomTokenValidator, DefaultCustomTokenValidator>();
         builder.Services.TryAddTransient<ICustomAuthorizeRequestValidator, DefaultCustomAuthorizeRequestValidator>();
 
+        // PAR support
+        builder.Services
+            .AddTransientDecorator<IAuthorizeRequestValidator,AuthorizeUsingPushedAuthorizationRequestValidator>();
+
         return builder;
     }
 
@@ -241,7 +246,8 @@ public static IIdentityServerBuilder AddResponseGenerators(this IIdentityServerB
         builder.Services.TryAddTransient<IDiscoveryResponseGenerator, DiscoveryResponseGenerator>();
         builder.Services.TryAddTransient<ITokenRevocationResponseGenerator, TokenRevocationResponseGenerator>();
         builder.Services.TryAddTransient<IDeviceAuthorizationResponseGenerator, DeviceAuthorizationResponseGenerator>();
-
+        builder.Services.TryAddTransient<IPushedAuthorizationResponseGenerator, PushedAuthorizationResponseGenerator>();
+
         return builder;
     }
 

src/Open.IdentityServer/src/Configuration/DependencyInjection/BuilderExtensions/InMemory.cs

@@ -163,7 +163,7 @@ public static IIdentityServerBuilder AddInMemoryPersistedGrants(this IIdentitySe
     {
         builder.Services.TryAddSingleton<IPersistedGrantStore, InMemoryPersistedGrantStore>();
         builder.Services.TryAddSingleton<IDeviceFlowStore, InMemoryDeviceFlowStore>();
-
+        builder.Services.TryAddSingleton<IPushedAuthorizationRequestStore, InMemoryPushedAuthorizationRequestStore>();
         return builder;
     }
 }

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/EndpointOptions.cs

@@ -85,4 +85,9 @@ public class EndpointsOptions
     /// <c>true</c> if the device authorization endpoint is enabled; otherwise, <c>false</c>.
     /// </value>
     public bool EnableDeviceAuthorizationEndpoint { get; set; } = true;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the pushed authorization endpoint is enabled.
+    /// </summary>
+    public bool EnablePushedAuthorizationRequestEndpoint { get; set; } = true;
 }

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/IdentityServerOptions.cs

@@ -141,4 +141,9 @@ public class IdentityServerOptions
     /// Gets or sets the enable authorise response issuer param option
     /// </summary>
     public bool EnableAuthorizeResponseIssuerParam { get; set; } = false;
+
+    /// <summary>
+    /// PAR authorization options
+    /// </summary>
+    public PushedAuthorizationOptions PushedAuthorization {get;} = new PushedAuthorizationOptions();
 }

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/PushedAuthorizationOptions.cs

@@ -0,0 +1,21 @@
+// Copyright (c) 2026, Rock Solid Knowledge Ltd
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+using System;
+
+namespace Open.IdentityServer.Configuration;
+
+/// <summary>
+/// PAR options
+/// </summary>
+public class PushedAuthorizationOptions
+{
+    /// <summary>
+    /// Enforce PAR for all authorization requests
+    /// </summary>
+    public bool Required { get; set; } = false;
+
+    /// <summary>
+    /// The lifetime of a PAR request_uri
+    /// </summary>
+    public TimeSpan Expiration { get; set; } = TimeSpan.FromSeconds(60);
+}

src/Open.IdentityServer/src/Constants.cs

@@ -205,13 +205,15 @@ public static class EndpointNames
         public const string EndSession = "Endsession";
         public const string CheckSession = "Checksession";
         public const string UserInfo = "Userinfo";
+        public const string PushedAuthorizationRequest = "PushedAuthorizationRequest";
     }
 
     public static class ProtocolRoutePaths
     {
         public const string ConnectPathPrefix       = "connect";
 
         public const string Authorize               = ConnectPathPrefix + "/authorize";
+        public const string PushedAuthorizationRequest = ConnectPathPrefix + "/par";
         public const string AuthorizeCallback       = Authorize + "/callback";
         public const string DiscoveryConfiguration  = ".well-known/openid-configuration";
         public const string DiscoveryWebKeys        = DiscoveryConfiguration + "/jwks";

src/Open.IdentityServer/src/Endpoints/AuthorizeEndpointBase.cs

@@ -83,6 +83,11 @@ internal async Task<IEndpointResult> ProcessAuthorizeRequestAsync(NameValueColle
         }
 
         var request = result.ValidatedRequest;
+        return await ProcessValidatedRequest(consent, request);
+    }
+
+    private async Task<IEndpointResult> ProcessValidatedRequest(ConsentResponse consent, ValidatedAuthorizeRequest request)
+    {
         LogRequest(request);
 
         // determine user interaction

src/Open.IdentityServer/src/Endpoints/PushedAuthorizationEndpoint.cs

@@ -0,0 +1,117 @@
+// Copyright (c) 2026, Rock Solid Knowledge Ltd
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Specialized;
+using System.Net;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Open.IdentityServer.Configuration;
+using Open.IdentityServer.Endpoints.Results;
+using Open.IdentityServer.Hosting;
+using Open.IdentityServer.Extensions;
+using Open.IdentityServer.ResponseHandling;
+using Open.IdentityServer.Services;
+using Open.IdentityServer.Validation;
+
+#nullable  enable
+namespace Open.IdentityServer.Endpoints;
+
+internal class PushedAuthorizationRequestEndpoint(
+    IdentityServerOptions options,
+    IClientSecretValidator clientSecretValidator,
+    IPushedAuthorizationRequestValidator validator ,
+    IPushedAuthorizationResponseGenerator responseGenerator,
+    ITelemetryService telemetry,
+    ILogger<PushedAuthorizationRequestEndpoint> logger) : IEndpointHandler
+{
+    public async Task<IEndpointResult> ProcessAsync(HttpContext requestContext)
+    {
+        using ITrace trace = telemetry.Trace(TelemetryConstants.TraceCategories.Basic, this);
+
+        if (options.Endpoints.EnablePushedAuthorizationRequestEndpoint == false)
+        {
+            return new StatusCodeResult(HttpStatusCode.NotFound);
+        }
+
+        logger.LogDebug("Start processing pushed authorization request");
+        if (!HttpMethods.IsPost(requestContext.Request.Method))
+        {
+            return Error(OidcConstants.TokenErrors.InvalidRequest);
+        }
+
+        ClientSecretValidationResult? clientValidationResult = await clientSecretValidator.ValidateAsync(requestContext);
+        if (clientValidationResult.IsError)
+        {
+            return Error(OidcConstants.TokenErrors.InvalidClient);
+        }
+
+        trace?.AddTag(TelemetryConstants.TagConstants.Client, clientValidationResult.Client.ClientId);
+
+        NameValueCollection? parParameters = await ParseForm(requestContext.Request);
+        if (parParameters == null)
+        {
+            return Error(OidcConstants.TokenErrors.InvalidRequest);
+        }
+        var validationContext = new PushedAuthorizationRequestValidationContext(parParameters);
+        return await ProcessRequest(requestContext, validationContext);
+    }
+
+    private async Task<IEndpointResult> ProcessRequest(
+        HttpContext requestContext,
+        PushedAuthorizationRequestValidationContext validationContext)
+    {
+        PushAuthorizationRequestValidationResult result = await validator
+            .ValidateAsync(validationContext, requestContext.RequestAborted);
+
+        telemetry.CountPushedAuthorizationRequest(
+            result.ValidatedAuthorizeRequest.ClientId ,
+            result.IsError ? result.Error : null);
+
+        if (result.IsError)
+        {
+            logger.LogError("Bad PAR request from {0}: {1}",
+                result.ValidatedAuthorizeRequest.ClientId,
+                result.Error);
+
+            return new BadRequestResult(result.Error, result.ErrorDescription);
+        }
+
+        PushedAuthorizationResponse response = await responseGenerator
+            .CreateResponseAsync(result.ValidatedAuthorizeRequest);
+
+        logger.LogTrace("End processing pushed authorization request");
+        return new PushedAuthorizationResult(response);
+    }
+
+    private async Task<NameValueCollection?> ParseForm(HttpRequest request)
+    {
+        try
+        {
+            IFormCollection form = await request.ReadFormAsync();
+            NameValueCollection parParameters = form.AsNameValueCollection();
+
+            return parParameters;
+        }
+        catch (InvalidOperationException  )
+        {
+            return null;
+        }
+    }
+
+    private TokenErrorResult Error(string error, string? errorDescription = null, Dictionary<string, object>? custom = null)
+    {
+        var response = new TokenErrorResponse
+        {
+            Error = error,
+            ErrorDescription = errorDescription,
+            Custom = custom
+        };
+
+        logger.LogError("PushedAuthorizationRequest error: {error}:{errorDescriptions}", error, error ?? "-no message-");
+
+        return new TokenErrorResult(response);
+    }
+}

src/Open.IdentityServer/src/Endpoints/Results/PushedAuthorizationResult.cs

@@ -0,0 +1,22 @@
+// Copyright (c) 2026, Rock Solid Knowledge Ltd
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Open.IdentityServer.Extensions;
+using Open.IdentityServer.Hosting;
+using Open.IdentityServer.ResponseHandling;
+
+namespace Open.IdentityServer.Endpoints.Results;
+
+internal record PushedAuthorizationResult(PushedAuthorizationResponse Response) : IEndpointResult
+{
+    public async Task ExecuteAsync(HttpContext context)
+    {
+        context.Response.StatusCode = StatusCodes.Status201Created;
+        context.Response.ContentType = "application/json";
+        context.Response.SetNoCache();
+
+        await context.Response.WriteAsJsonAsync(Response);
+    }
+}

src/Open.IdentityServer/src/IdentityServerConstants.cs

@@ -17,6 +17,14 @@ public static class IdentityServerConstants
     public const string DefaultCheckSessionCookieName = "idsrv.session";
     public const string AccessTokenAudience = "{0}resources";
 
+    public static class PushedAuthorizationRequest
+    {
+        /// <summary>
+        /// Standard prefix for the generated URI for a Pushed Authorization Request
+        /// </summary>
+        public static readonly string UriRequestPrefix = "urn:ietf:params:oauth:request_uri:";
+    }
+
     public const string JwtRequestClientKey = "idsrv.jwtrequesturi.client";
 
     /// <summary>

src/Open.IdentityServer/src/OidcConstants.cs

@@ -933,6 +933,12 @@ public static class Discovery
         // DPoP
         /// <summary>JSON array of JWS signing algorithms supported by the OP for DPoP proofs.</summary>
         public const string DPoPSigningAlgorithmsSupported = "dpop_signing_alg_values_supported";
+
+        // PAR
+        /// <summary> The endpoint to use for PAR </summary>
+        public const string PushedAuthorizationRequestEndpoint = "pushed_authorization_request_endpoint";
+        /// <summary> Used to indicate to a client that it MUST use PAR to perform authorization code flow </summary>
+        public const string RequirePushedAuthorizationRequests = "require_pushed_authorization_requests";
     }
 
     /// <summary>

src/Open.IdentityServer/src/Open.IdentityServer.csproj

@@ -48,5 +48,9 @@
         <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect"/>
         <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All"/>
     </ItemGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\..\Storage\src\Open.IdentityServer.Storage.csproj" />
+    </ItemGroup>
 
 </Project>

src/Open.IdentityServer/src/Properties/AssemblyInfo.cs

@@ -5,4 +5,6 @@
 using System.Runtime.CompilerServices;
 
 [assembly: InternalsVisibleTo("Open.IdentityServer.UnitTests, PublicKey = 002400000480000094000000060200000024000052534131000400000100010057b24455efc2a317afb0644a2169c05644e439985c42cf4eb98706779651801add1da073da8b5e253e8d4335d59b3197bb941ebe943c63f7efbc3005c428f0d69b809e86bdc828fa431fae4b71005f26b52a26a3ee5cf0f6fdf744d4534a7a503683123f58e1082828b018245d2e40d8542f72a623c01490d73a5d3ff94a88c5")]
-[assembly: InternalsVisibleTo("Open.IdentityServer.IntegrationTests, PublicKey = 002400000480000094000000060200000024000052534131000400000100010057b24455efc2a317afb0644a2169c05644e439985c42cf4eb98706779651801add1da073da8b5e253e8d4335d59b3197bb941ebe943c63f7efbc3005c428f0d69b809e86bdc828fa431fae4b71005f26b52a26a3ee5cf0f6fdf744d4534a7a503683123f58e1082828b018245d2e40d8542f72a623c01490d73a5d3ff94a88c5")]
+[assembly: InternalsVisibleTo("Open.IdentityServer.IntegrationTests, PublicKey = 002400000480000094000000060200000024000052534131000400000100010057b24455efc2a317afb0644a2169c05644e439985c42cf4eb98706779651801add1da073da8b5e253e8d4335d59b3197bb941ebe943c63f7efbc3005c428f0d69b809e86bdc828fa431fae4b71005f26b52a26a3ee5cf0f6fdf744d4534a7a503683123f58e1082828b018245d2e40d8542f72a623c01490d73a5d3ff94a88c5")]
+[assembly: System.Runtime.CompilerServices.InternalsVisibleTo(
+    "DynamicProxyGenAssembly2, PublicKey=0024000004800000940000000602000000240000525341310004000001000100c547cac37abd99c8db225ef2f6c8a3602f3b3606cc9891605d02baa56104f4cfc0734aa39b93bf7852f7d9266654753cc297e7d2edfe0bac1cdcf9f717241550e0a7b191195b7667bb4f64bcb8e2121380fd1d9d46ad2d92d2d15605093924cceaf74c4861eff62abf69b9291ed0a340e113be11e6a7d3113e92484cf7045cc7")]

src/Open.IdentityServer/src/ResponseHandling/Default/DiscoveryResponseGenerator.cs

@@ -208,9 +208,12 @@ string ConstructMtlsEndpoint(string endpoint)
                         return $"https://{Options.MutualTls.DomainName}.{parts[1]}{endpoint}";
                     }
                 }
+
+
             }
+            AddPushedAuthorizationRequestEndpoint(baseUrl, entries);
         }
-
+        
         // logout
         if (Options.Endpoints.EnableEndSessionEndpoint)
         {
@@ -369,10 +372,32 @@ where scope.ShowInDiscoveryDocument
                 }
             }
         }
+
 
         return entries;
     }
 
+    private void AddPushedAuthorizationRequestEndpoint(string baseUrl, Dictionary<string, object> entries)
+    {
+        if (Options.Endpoints.EnablePushedAuthorizationRequestEndpoint == false)
+        {
+            return;
+        }
+
+        string parPath = $"{baseUrl}{Constants.ProtocolRoutePaths.PushedAuthorizationRequest}";
+
+        entries.Add(OidcConstants.Discovery.PushedAuthorizationRequestEndpoint, parPath);
+
+        // If PAR is enabled
+        if (Options.Endpoints.EnablePushedAuthorizationRequestEndpoint)
+        {
+            entries.Add(
+                OidcConstants.Discovery.RequirePushedAuthorizationRequests,
+                Options.PushedAuthorization.Required
+            );
+        }
+    }
+
     /// <summary>
     /// Creates the JWK document.
     /// </summary>