#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication')

## TlsClientAuthenticator Class

Implements RFC 8705 self\-signed TLS client authentication \(self\_signed\_tls\_client\_auth\)\.
Validates the presented client certificate by matching its public key against the client's
registered JWKS \(jwks or jwks\_uri\)\. If matched and the client's configured token endpoint
auth method is `self_signed_tls_client_auth`, the client is authenticated\.

```csharp
public class TlsClientAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TlsClientAuthenticator

Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator')
### Constructors

## TlsClientAuthenticator\(ILogger\<TlsClientAuthenticator\>, IClientInfoProvider, IClientKeysProvider\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider)}

Implements RFC 8705 self\-signed TLS client authentication \(self\_signed\_tls\_client\_auth\)\.
Validates the presented client certificate by matching its public key against the client's
registered JWKS \(jwks or jwks\_uri\)\. If matched and the client's configured token endpoint
auth method is `self_signed_tls_client_auth`, the client is authenticated\.

```csharp
public TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator> logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider clientKeysProvider);
```
#### Parameters

###### `logger` [Microsoft\.Extensions\.Logging\.ILogger&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[TlsClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsClientAuthenticator')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider).logger}

###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider).clientInfoProvider}

###### `clientKeysProvider` [IClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider).clientKeysProvider}
### Properties

## TlsClientAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.ClientAuthenticationMethodsSupported}

Gets the collection of client authentication methods supported by this authenticator\.

```csharp
public System.Collections.Generic.IEnumerable<string> ClientAuthenticationMethodsSupported { get; }
```

Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported')

#### Property Value
[System\.Collections\.Generic\.IEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')  
A collection containing [SelfSignedTlsClientAuth](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.SelfSignedTlsClientAuth 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientAuthenticationMethods\.SelfSignedTlsClientAuth')\.
### Methods

## TlsClientAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)}

Attempts to authenticate a client using self\-signed TLS client authentication\.
Validates the client certificate's public key against the client's registered JWKS\.

```csharp
public System.Threading.Tasks.Task<Abblix.Oidc.Server.Features.ClientInformation.ClientInfo?> TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request);
```
#### Parameters

###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request}

The client request containing the certificate and client ID to authenticate\.

Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
A task that returns the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') if successful; otherwise, null\.
Returns null if no certificate is provided, client not found, authentication method doesn't match,
or certificate public key doesn't match any key in the client's JWKS\.

### Remarks
This method implements RFC 8705 self\_signed\_tls\_client\_auth by:
1\. Verifying a client certificate is present
2\. Looking up client configuration by client\_id
3\. Checking the client uses self\_signed\_tls\_client\_auth method
4\. Extracting the public key from the certificate
5\. Comparing it against all keys in the client's JWKS \(jwks or jwks\_uri\)
Supports both RSA and ECDSA certificates\.