ServiceTokenOptions Class

The signing and encryption settings for one type of JWT the authorization server issues for itself (access, refresh, registration access or initial access token). The same shape is reused for every type via ServiceTokensOptions.

public record ServiceTokenOptions : System.IEquatable<Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions>

Inheritance System.Object → ServiceTokenOptions

Implements System.IEquatable<ServiceTokenOptions>

Properties

ServiceTokenOptions.Encrypt Property

Whether to encrypt this token type to the server's own encryption key.

public System.Nullable<bool> Encrypt { get; set; }

Property Value

System.Nullable<System.Boolean>

Remarks

Three states, and the difference between two of them decides how a missing key is answered:

• false keeps the token a signed JWS even when an encryption key exists, for example to keep the access token readable by external resource servers that validate it against the published key set. The server's encryption keys are not resolved at all.
• true requires encryption. If no encryption key can be resolved the server refuses to issue the token rather than falling back to a signed JWS, because a host that asked for confidentiality and silently did not get it has no way to find out.
• null, the default, states nothing: the token is encrypted when a server encryption key is available and signed only when none is, which is the behaviour of prior versions. A host that never touched this setting therefore sees no change and no new failure.

ServiceTokenOptions.Encryption Property

How this token type is encrypted when Encrypt is on and a server encryption key is available: the JWE key-management algorithm and the key to use. Left at its defaults it derives the algorithm from the selected key and takes the first configured encryption key.

public Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings Encryption { get; set; }

Property Value

JwtEncryptionSettings

ServiceTokenOptions.Signing Property

The signing settings, always present. Left at its defaults it signs with RS256 and lets the server choose the first matching key, reproducing the output the server produced before this option existed.

public Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings Signing { get; set; }

Property Value

JwtSigningSettings