#### [Abblix\.Oidc\.Server](https://www.abblix.com/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Common\.Configuration Namespace

| Classes | |
| :--- | :--- |
| [BackChannelAuthenticationOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelAuthenticationOptions') | Provides configuration options for the backchannel authentication process\. |
| [BackChannelLogoutOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelLogoutOptions') | Back\-channel logout settings for a single client, as defined by the OpenID Connect Back\-Channel Logout 1\.0 specification\. The OP delivers a signed logout token directly \(server\-to\-server\) to the configured endpoint when an end\-session occurs, bypassing the user agent\. |
| [CheckSessionCookieOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.CheckSessionCookieOptions') | Defines options for the session check cookie used in monitoring changes in session status\. |
| [ClientIdOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientIdOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientIdOptions') | Represents options for generating client IDs\. |
| [ClientJwksConfigurationExtensions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions') | Configuration\-time extensions that populate [Jwks](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Jwks 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.Jwks') from raw configuration sections by binding into [JsonWebKeySetSettings](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings') \(a flat DTO that [Microsoft\.Extensions\.Configuration](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.configuration 'Microsoft\.Extensions\.Configuration') can handle natively\) and mapping to the polymorphic [JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') hierarchy\. |
| [ClientSecretOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientSecretOptions') | Configuration options for generating client secrets in OAuth2/OpenID Connect authentication\. |
| [ClientSecretsOptionsValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretsOptionsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientSecretsOptionsValidator') | Fails loudly at startup when a configured client cannot authenticate with the secret it appears to carry, instead of answering `invalid_client` to every request it ever makes\. |
| [ClockSkewCeilingValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClockSkewCeilingValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClockSkewCeilingValidator') | Refuses a configured clock skew the validator would not honour, while the host is still starting \- and only where a profile puts a bound on it at all\. |
| [DefaultResourceIndicatorValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DefaultResourceIndicatorValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.DefaultResourceIndicatorValidator') | Refuses at startup a [DefaultResourceIndicator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultResourceIndicator 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultResourceIndicator') that would put an unusable value in every access token's `aud` claim\. |
| [DeviceAuthorizationOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DeviceAuthorizationOptions') | Provides configuration options for the Device Authorization Grant \(RFC 8628\)\. |
| [DiscoveryOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DiscoveryOptions') | Defines discovery endpoint options\. |
| [DPoPNonceOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') | DPoP\-specific extension of [NonceOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') per RFC 9449 §8\. Inherits the generic primitive's `AcceptanceWindow` and `RotationInterval` so DPoP can override them independently of any other nonce\-service consumer, and adds the per\-endpoint policy that says which OAuth endpoints reject DPoP proofs without a `nonce` claim \(responding with `use_dpop_nonce` and a fresh `DPoP-Nonce` header\)\. |
| [DPoPOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPOptions') | Configuration options for OAuth 2\.0 DPoP \(RFC 9449\), covering the proof validator's `iat` tolerance and DPoP\-specific nonce policy\. The nonce sub\-section inherits from the generic [NonceOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') so DPoP can configure stricter values independently of other nonce\-service consumers without duplicating field definitions\. |
| [FrontChannelLogoutOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.FrontChannelLogoutOptions') | Front\-channel logout settings for a single client, as defined by the OpenID Connect Front\-Channel Logout 1\.0 specification\. Tells the authorization server which URL to load in a hidden iframe during end\-session processing and whether the iframe URL must carry the user's session identifier\. |
| [JsonWebKeySetSettings](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings') | Flat configuration DTO for a [JsonWebKeySet](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet'), mirroring RFC 7517 Section 5 \(a JSON object with a single `keys` array\)\. See [JsonWebKeySettings](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings') for the per\-key DTO and the design rationale\. |
| [JsonWebKeySettings](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings') | Flat configuration DTO for a single JSON Web Key, suitable for binding via `Microsoft.Extensions.Configuration` which cannot instantiate the abstract [JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') base type directly\. All cryptographic byte\-array members are bound as base64url\-encoded strings per RFC 7517; [ToJsonWebKey\(\)](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.ToJsonWebKey\(\)') decodes them and maps the flat shape to the correct concrete subtype based on [Kty](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Kty 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.Kty')\. |
| [JwtBearerOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions') | Configuration options for JWT Bearer grant type \(RFC 7523\)\. Defines trusted external identity providers whose JWT assertions can be exchanged for access tokens\. |
| [JwtEncryptionSettings](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtEncryptionSettings') | How a JWT the authorization server issues for itself is encrypted\. Reused, one instance per service token type\. Whether the token is encrypted at all is governed by [Encrypt](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt'); this block only selects the key\-management algorithm and key used when it is\. |
| [JwtSigningSettings](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtSigningSettings') | The signing settings for a JWT the authorization server issues for itself\. Reused, one instance per service token type, so each type carries its own explicit JWS `alg` and signing\-key selection instead of the previously hardcoded RS256\. |
| [MtlsAliasesOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.MtlsAliasesOptions') | Options for RFC 8705 mTLS endpoint aliases in discovery\. Allows explicitly setting alias URIs\. Use DiscoveryOptions\.MtlsBaseUri to auto\-compute aliases\. |
| [NewClientOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.NewClientOptions') | Defaults used by the dynamic client registration endpoint when minting credentials for a newly registered client: how its client identifier and client secret are generated and how long the secret stays valid\. |
| [OidcOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') | The root of the OIDC configuration\. Provides the simplest way to configure and start your OIDC server\. |
| [RegistrationRequestSizeValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RegistrationRequestSizeValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.RegistrationRequestSizeValidator') | Refuses at startup a [MaxRegistrationRequestSize](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.MaxRegistrationRequestSize 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.MaxRegistrationRequestSize') that no request could satisfy\. |
| [RevocationRetentionOptionsValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RevocationRetentionOptionsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.RevocationRetentionOptionsValidator') | Fails at startup on a revocation setting that would let a revocation report success and do nothing\. |
| [SecretLengthOptionsValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SecretLengthOptionsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.SecretLengthOptionsValidator') | Fails loudly at startup when a configured secret\-bearing length is below the security floor for its kind, instead of silently generating a guessable client secret, authorization code or identifier at runtime\. Every shipped default is already at or above these floors, so a valid configuration is unaffected; the validator only rejects a deliberately shortened value\. |
| [ServiceTokenOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions') | The signing and encryption settings for one type of JWT the authorization server issues for itself \(access, refresh, registration access or initial access token\)\. The same shape is reused for every type via [ServiceTokensOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions')\. |
| [ServiceTokensAlgorithmsValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensAlgorithmsValidator') | Fails loudly at startup when a configured [ServiceTokensOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') names a signing or key\-management algorithm that no registered signer or encryptor can produce, instead of letting the contradiction surface at token\-issuance time as a per\-request failure\. The accepted sets are read from the live JWT registrations, the same union OpenID Connect discovery advertises, so a host that adds or replaces an algorithm is validated against exactly what it registered \- no static allow\-list to keep in sync\. |
| [ServiceTokensOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') | The per\-type signing and encryption settings for the four JWTs the authorization server issues for itself\. Grouping the four here keeps them together and avoids a name clash with the per\-client [RefreshToken](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RefreshToken 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RefreshToken') \(which governs lifetime and reuse, a different concern\)\. Each token type signs with RS256 and, when a server encryption key is configured, is encrypted to it by default, as in prior versions; a host disables encryption for a specific type by setting that type's [Encrypt](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') to `false`\. |
| [SoftwareStatementOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.SoftwareStatementOptions') | Configuration options for software statement validation per RFC 7591 Section 2\.3\. Software statements are signed JWTs issued by a third\-party authority asserting metadata values about the client software\. |
| [TrustedIssuer](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer') | Represents a trusted external identity provider for JWT Bearer grant type\. |

| Structs | |
| :--- | :--- |
| [RefreshTokenOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.RefreshTokenOptions') | Lifetime and reuse policy for refresh tokens issued by the token endpoint\. Combines an absolute ceiling with an optional sliding window so long\-running sessions stay alive only while the client keeps using them\. |

| Enums | |
| :--- | :--- |
| [OidcEndpoints](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints') | Flags representing the various OpenID Connect \(OIDC\) endpoints that the provider can expose\. These flags enable fine\-grained control over which endpoints are enabled or disabled\. |