#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces')

## IMtlsUserInfoValidator Interface

Validates the mutual\-TLS certificate\-binding contract on a UserInfo request per
RFC 8705 §3: when the inbound access token is certificate\-bound \(carries
`cnf.x5t#S256`\), the protected resource MUST obtain the client certificate used for
mutual TLS and verify that its SHA\-256 thumbprint matches the bound value, rejecting the
request otherwise\. Unbound access tokens bypass the check\. Sibling of
[IDPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator'): the two proof\-of\-possession mechanisms \(DPoP
`cnf.jkt` and mTLS `cnf.x5t#S256`\) are independent and a token carrying both
must satisfy each\.

```csharp
public interface IMtlsUserInfoValidator
```

Derived  
↳ [MtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.MtlsUserInfoValidator')
### Methods

## IMtlsUserInfoValidator\.Validate\(ClientRequest, JsonWebToken\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken)}

Returns `null` when the binding holds \(or the token is not certificate\-bound\),
and an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `invalid_token` when the token is bound but
the presented certificate is absent or its thumbprint does not match
`cnf.x5t#S256` \(RFC 8705 §3 — HTTP 401, per RFC 6750\)\.

```csharp
Abblix.Oidc.Server.Common.OidcError? Validate(Abblix.Oidc.Server.Model.ClientRequest clientRequest, Abblix.Jwt.JsonWebToken accessToken);
```
#### Parameters

###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).clientRequest}

Carries the client certificate presented on the mutual\-TLS
            connection \(when any\)\.

###### `accessToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).accessToken}

The parsed access\-token JWT whose `cnf.x5t#S256`
            \(when present\) the presented certificate must match\.

#### Returns
[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')