#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation')

## MtlsUserInfoValidator Class

Resource\-server\-side enforcement of RFC 8705 §3 mutual\-TLS certificate\-bound access tokens
at the UserInfo endpoint\. Mirrors the role of [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') for the
`cnf.x5t#S256` binding: when the access token is certificate\-bound, the SHA\-256
thumbprint of the certificate presented on the mutual\-TLS connection MUST match the bound
value, otherwise the request is rejected with `invalid_token` \(HTTP 401, per RFC 6750\)\.

```csharp
public class MtlsUserInfoValidator : Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → MtlsUserInfoValidator

Implements [IMtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IMtlsUserInfoValidator')
### Methods

## MtlsUserInfoValidator\.Validate\(ClientRequest, JsonWebToken\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken)}

Returns `null` when the binding holds \(or the token is not certificate\-bound\),
and an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `invalid_token` when the token is bound but
the presented certificate is absent or its thumbprint does not match
`cnf.x5t#S256` \(RFC 8705 §3 — HTTP 401, per RFC 6750\)\.

```csharp
public Abblix.Oidc.Server.Common.OidcError? Validate(Abblix.Oidc.Server.Model.ClientRequest clientRequest, Abblix.Jwt.JsonWebToken accessToken);
```
#### Parameters

###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).clientRequest}

Carries the client certificate presented on the mutual\-TLS
            connection \(when any\)\.

###### `accessToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).accessToken}

The parsed access\-token JWT whose `cnf.x5t#S256`
            \(when present\) the presented certificate must match\.

Implements [Validate\(ClientRequest, JsonWebToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken) 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IMtlsUserInfoValidator\.Validate\(Abblix\.Oidc\.Server\.Model\.ClientRequest, Abblix\.Jwt\.JsonWebToken\)')

#### Returns
[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')