ClockSkewCeilingValidator Class

Refuses a configured clock skew the validator would not honour, while the host is still starting - and only where a profile puts a bound on it at all.

public sealed class ClockSkewCeilingValidator : Microsoft.Extensions.Options.IValidateOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions>

Inheritance System.Object → ClockSkewCeilingValidator

Implements Microsoft.Extensions.Options.IValidateOptions<OidcOptions>

Remarks

FAPI 2.0 Security Profile section 5.3.2.1: a server held to it "shall reject JWTs with an iat or nbf timestamp greater than 60 seconds in the future". RFC 7523 Section 3, which governs a bearer assertion outside that profile, names no bound, so a deployment not held to a profile may legitimately allow minutes and this guard says nothing to it.

Where a bound does apply, the validator holds it whatever is configured - so this guard is not what makes the requirement true. It exists because a setting that is silently clamped is worse than one that is refused: a deployment could set a window, read the setting back, and believe a number the validator was cutting down. This says which value and which bound, at startup, where the operator is still looking.