#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer 'Abblix\.Oidc\.Server\.Features\.JwtBearer')

## JwtBearerIssuerProvider Class

Default implementation of [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') that loads trusted issuers
from [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer') configuration, fetches JWKS with SSRF protection,
and provides JWT replay protection\.

```csharp
public class JwtBearerIssuerProvider : Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtBearerIssuerProvider

Implements [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider')
### Constructors

## JwtBearerIssuerProvider\(ILogger\<JwtBearerIssuerProvider\>, IOptionsMonitor\<OidcOptions\>, IJwtReplayCache, ISecureHttpFetcher\) Constructor {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher)}

Default implementation of [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') that loads trusted issuers
from [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer') configuration, fetches JWKS with SSRF protection,
and provides JWT replay protection\.

```csharp
public JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider> logger, Microsoft.Extensions.Options.IOptionsMonitor<Abblix.Oidc.Server.Common.Configuration.OidcOptions> oidcOptions, Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache replayCache, Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher secureFetcher);
```
#### Parameters

###### `logger` [Microsoft\.Extensions\.Logging\.ILogger&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[JwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.JwtBearerIssuerProvider')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).logger}

Logger for recording JWKS fetch operations and errors\.

###### `oidcOptions` [Microsoft\.Extensions\.Options\.IOptionsMonitor&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).oidcOptions}

OIDC configuration options containing JWT Bearer trusted issuers\.

###### `replayCache` [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).replayCache}

Cache for JWT replay protection per RFC 7523 Section 5\.2\.

###### `secureFetcher` [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).secureFetcher}

HTTP fetcher with SSRF protection and JWKS caching\.
### Fields

## JwtBearerIssuerProvider\.SecureHttpFetcherKey Field {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.SecureHttpFetcherKey}

The keyed service key used to resolve the caching [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') for JWKS fetching\.

```csharp
public const string SecureHttpFetcherKey = "JwtBearerJwks";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')
### Properties

## JwtBearerIssuerProvider\.Options Property {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.Options}

Gets the JWT Bearer configuration options\.

```csharp
public Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions Options { get; }
```

Implements [Options](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.Options 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.Options')

#### Property Value
[JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions')
### Methods

## JwtBearerIssuerProvider\.GetSigningKeysAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetSigningKeysAsync(string)}

Resolves the signing keys for a trusted issuer by fetching the JWKS from the configured JWKS URI
with SSRF \(Server\-Side Request Forgery\) protection\.

```csharp
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetSigningKeysAsync(string issuer);
```
#### Parameters

###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetSigningKeysAsync(string).issuer}

The issuer identifier from the JWT's 'iss' claim\.

Implements [GetSigningKeysAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetSigningKeysAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.GetSigningKeysAsync\(string\)')

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')  
An async enumerable of JSON Web Keys from the issuer's JWKS endpoint\.
Returns empty if the issuer is not trusted or if fetching JWKS fails\.

### Remarks
This implementation:
\- Looks up the issuer in the trusted issuers configuration
\- Fetches the JWKS from the configured JwksUri using ISecureHttpFetcher \(SSRF protected\)
\- JWKS responses are cached according to [JwksCacheDuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.JwksCacheDuration 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions\.JwksCacheDuration')
\- Filters keys to return only those suitable for signature verification
\- Logs warnings if JWKS fetching fails

## JwtBearerIssuerProvider\.GetTrustedIssuerAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetTrustedIssuerAsync(string)}

Gets the full configuration for a trusted issuer\.

```csharp
public System.Threading.Tasks.Task<Abblix.Oidc.Server.Common.Configuration.TrustedIssuer?> GetTrustedIssuerAsync(string issuer);
```
#### Parameters

###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetTrustedIssuerAsync(string).issuer}

The issuer identifier from the JWT's 'iss' claim\.

Implements [GetTrustedIssuerAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetTrustedIssuerAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.GetTrustedIssuerAsync\(string\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
A task that completes with the trusted issuer configuration if found; null if not trusted\.

## JwtBearerIssuerProvider\.IsReplayedAsync\(string, Nullable\<DateTimeOffset\>\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_)}

Atomically records the JWT's JTI for replay protection and reports whether it had already
been recorded\. The entry is kept until the assertion's own expiration, so a JWT cannot be
replayed for any part of its validity window\.

```csharp
public System.Threading.Tasks.Task<bool> IsReplayedAsync(string jti, System.Nullable<System.DateTimeOffset> expiresAt);
```
#### Parameters

###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_).jti}

The JWT ID \(jti claim\) to reserve\.

###### `expiresAt` [System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt}

The assertion's expiration; bounds how long the JTI is remembered\.

Implements [IsReplayedAsync\(string, Nullable&lt;DateTimeOffset&gt;\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.IsReplayedAsync\(string, System\.Nullable\<System\.DateTimeOffset\>\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
True if this JTI was already recorded \(a replay\); false if it was recorded just now\.

## JwtBearerIssuerProvider\.IsTrustedIssuerAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsTrustedIssuerAsync(string)}

Determines whether the specified issuer is trusted for JWT Bearer assertions\.
Checks against the configured list of trusted issuers in [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer')\.

```csharp
public System.Threading.Tasks.Task<bool> IsTrustedIssuerAsync(string issuer);
```
#### Parameters

###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsTrustedIssuerAsync(string).issuer}

The issuer identifier from the JWT's 'iss' claim\.

Implements [IsTrustedIssuerAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsTrustedIssuerAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.IsTrustedIssuerAsync\(string\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
A task that completes with true if the issuer is in the trusted issuers list; otherwise, false\.